VendorsRed Hatfuse7.0.0
Vulnerabilities

Red Hat Fuse 7.0.0

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

12CVEs
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
Published 2026-06-12 · Analyzed
9.8EPSS 0.007
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
Published 2026-06-12 · Analyzed
9.8EPSS 0.005
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
Published 2026-01-07 · Modified
9.6EPSS 0.013
CVE-2026-50627
Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
Published 2026-06-12 · Analyzed
9.1EPSS 0.041
CVE-2026-28368
Undertow: undertow: request smuggling via inconsistent header parsing
Published 2026-03-27 · Modified
9.1EPSS 0.007
CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
Published 2026-03-27 · Modified
9.1EPSS 0.007
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers
Published 2026-03-27 · Modified
9.1EPSS 0.007
CVE-2026-50632
Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
Published 2026-06-12 · Analyzed
8.8EPSS 0.007
CVE-2026-50633
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Published 2026-06-12 · Analyzed
8.1EPSS 0.009
CVE-2026-41731
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
Published 2026-06-09 · Analyzed
8.1EPSS 0.005
CVE-2025-9784
Undertow: undertow madeyoureset http/2 ddos vulnerability
Published 2025-09-02 · Modified
7.5EPSS 0.023
CVE-2025-57849
Fuse: privilege escalation via excessive /etc/passwd permissions
Published 2026-03-13 · Analyzed
6.4EPSS 0.002