Approved changes feed: RSS · Atom

cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*

part: a version: 8.0.0 update: *

VendorRedhat (e942785a-ca89-506e-bd99-50782639cde3)
ProductJboss Enterprise Application Platform (1fae2c77-9ea1-5c62-8727-311c31afda6c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-4874 vulnerable 2026-06-08 08:07:02.571446 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
LOW (3.1)
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Published: 2026-03-26T07:12:37.545Z
Updated: 2026-06-26T07:01:28.059Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-4366 vulnerable 2026-06-08 08:05:13.289353 Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
MEDIUM (5.8)
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Published: 2026-03-18T04:02:59.959Z
Updated: 2026-06-09T16:36:05.369Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-3260 vulnerable 2026-06-08 08:01:18.280783 Details available
Published: 2026-03-24T04:11:16.085Z
Updated: 2026-07-07T19:50:22.087Z
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-3121 vulnerable 2026-06-08 08:01:17.888005 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
MEDIUM (6.5)
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
Published: 2026-03-26T19:13:26.086Z
Updated: 2026-04-02T16:39:35.672Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28369 vulnerable 2026-06-08 07:55:15.208368 Undertow: undertow: request smuggling via malformed http request headers
HIGH (8.7)
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
Published: 2026-03-27T16:13:05.719Z
Updated: 2026-07-22T05:35:33.436Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28368 vulnerable 2026-06-08 07:55:15.203601 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28367 vulnerable 2026-06-08 07:55:15.198580 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-9784 vulnerable 2026-06-08 07:47:09.794680 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-5731 vulnerable 2026-06-08 07:37:25.621573 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-23368 vulnerable 2026-06-08 07:10:55.597822 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-7885 vulnerable 2026-06-08 06:58:23.810579 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.