Red Hat JBoss Enterprise Application Platform (EAP) Expansion Pack

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*

part: a version: - update: *

VendorRedhat (e942785a-ca89-506e-bd99-50782639cde3)
ProductJboss Enterprise Application Platform Expansion Pack (72d2630a-6af3-50a3-b0b5-66076f5fd5d5)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-4874 vulnerable 2026-06-08 08:07:02.572393 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
LOW (3.1)
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Published: 2026-03-26T07:12:37.545Z
Updated: 2026-06-26T07:01:28.059Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-4366 vulnerable 2026-06-08 08:05:13.290374 Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
MEDIUM (5.8)
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Published: 2026-03-18T04:02:59.959Z
Updated: 2026-06-09T16:36:05.369Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-3260 vulnerable 2026-06-08 08:01:18.280890 Details available
Published: 2026-03-24T04:11:16.085Z
Updated: 2026-07-07T19:50:22.087Z
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-3121 vulnerable 2026-06-08 08:01:17.888062 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
MEDIUM (6.5)
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
Published: 2026-03-26T19:13:26.086Z
Updated: 2026-04-02T16:39:35.672Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-3009 vulnerable 2026-06-08 08:01:17.311881 Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)
HIGH (8.1)
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
Published: 2026-03-05T18:27:43.294Z
Updated: 2026-07-15T01:10:09.461Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28369 vulnerable 2026-06-08 07:55:15.208388 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28368 vulnerable 2026-06-08 07:55:15.203730 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28367 vulnerable 2026-06-08 07:55:15.199593 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-9784 vulnerable 2026-06-08 07:47:09.795580 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-5731 vulnerable 2026-06-08 07:37:25.622540 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-12543 vulnerable 2026-06-08 07:04:30.408539 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-4503 vulnerable 2026-06-08 06:16:12.822447 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-1108 vulnerable 2026-06-08 05:52:33.882182 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-1278 vulnerable 2026-06-08 05:39:12.610680 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-0853 vulnerable 2026-06-08 05:39:11.343541 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-3642 vulnerable 2026-06-08 05:33:53.266952 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-20250 vulnerable 2026-06-08 05:29:08.812996 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.