redhat jboss enterprise application platform expansion pack

Name: redhat jboss enterprise application platform expansion pack
Brand: redhat

productUS

cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

4critical7high2medium2low

updated 2026-10-27

vulnerabilities (23)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-9784US	—	2.33% (83rd)	Exploit	no fix	2025-09-02	—
CVE-2022-0853US	high7.5	1.45% (73rd)	Exploit	no fix	2022-03-11	—
CVE-2025-12543US	critical9.6	1.33% (71st)	Exploit	no fix	2026-01-07	—
CVE-2023-1108US	high7.5	1.77% (78th)	—	no fix	2023-09-14	—
CVE-2022-1278US	high7.5OT elevated	0.86% (58th)	—	no fix	2022-09-13	—
CVE-2021-3642US	medium5.3	0.85% (58th)	—	no fix	2021-08-05	—
CVE-2021-20250US	medium4.3	0.74% (54th)	—	no fix	2021-05-13	—
CVE-2026-28368US	critical9.1	0.73% (54th)	—	no fix	2026-03-27	—
CVE-2023-4503US	high7.5	0.72% (54th)	—	no fix	2024-02-06	—
CVE-2026-28367US	critical9.1	0.72% (54th)	—	no fix	2026-03-27	—
CVE-2026-28369US	critical9.1	0.69% (53rd)	—	no fix	2026-03-27	—
CVE-2026-41731US	—	0.51% (43rd)	—	no fix	2026-06-10	—
CVE-2026-3121US	high7.2	0.48% (41st)	—	no fix	2026-03-26	—
CVE-2026-16102US	—	0.46% (40th)	—	no fix	2026-08-05	—
CVE-2026-15573US	—	0.46% (40th)	—	no fix	2026-08-05	—
CVE-2026-16093US	—	0.39% (33rd)	—	no fix	2026-07-17	—
CVE-2026-14209US	—	0.39% (32nd)	—	no fix	2026-06-30	—
CVE-2026-4874US	low3.1	0.35% (29th)	—	no fix	2026-03-26	—
CVE-2026-15945US	low2.7	0.35% (28th)	—	no fix	2026-07-16	—
CVE-2026-3009US	high8.1OT elevated	0.35% (28th)	—	no fix	2026-03-05	—
CVE-2026-4366US	—	0.24% (15th)	—	no fix	2026-03-18	—
CVE-2026-18967US	high8.1OT elevated	0.23% (14th)	—	no fix	2026-08-06	—
CVE-2025-5731US	—	0.17% (6th)	—	no fix	2025-06-26	—

The flaw types (CWEs) most of these CVEs share.

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')3 CVEs
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization2 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-1188Initialization of a Resource with an Insecure Default1 CVEs
CWE-178Improper Handling of Case Sensitivity1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.