CVE-2026-17614

CVE-2026-17614 affects WildFly-core in domain mode. The LocalFileRepository.getFile() and getConfigurationFile() do not ensure that resolved paths stay within the configured repository or configuration root, enabling a path traversal via crafted relative paths (e.g., ../../etc/passwd) sent throug...

CVE-2026-17614

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

EUVD-2026-52568

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CVE-2026-17614

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CVE-2026-41939

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

EUVD-2026-50439

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

CVE-2026-41939 Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

CVE-2026-41939

Summary: CVE-2026-41939 affects Care Everywhere Gateway 14.3.10, where a hard-coded credential flaw in the bundled WildFly 8.2.0.Final management interface enables unauthenticated remote access to the WildFly admin console (port 20990) with default credentials. This allows deployment of a malicio...

PT-2026-65863

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, debezium-connector-db2, strimzi-kafka-operator, cassandra, apache-nifi, wildfly, apicurio-registry, cassandra-reaper, apache-pulsar, debezium-connector-informix, thingsboard, confluent-kafka, akhq, debezium-connector-vitess, kafka...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, debezium-connector-db2, strimzi-kafka-operator, cassandra, apache-nifi, wildfly, apicurio-registry, cassandra-reaper, apache-pulsar, debezium-connector-informix, thingsboard, confluent-kafka, akhq, debezium-connector-vitess, kafka...

GHSA-RF99-F9J2-GV3F vulnerabilities

Vulnerabilities for packages: wildfly...

CVE-2026-40914 vulnerabilities

Vulnerabilities for packages: wildfly...

GHSA-RF99-F9J2-GV3F vulnerabilities

Vulnerabilities for packages: wildfly...

CVE-2026-40914 vulnerabilities

Vulnerabilities for packages: wildfly...

org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2026-50020 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator, neo4j, logstash, druid, management-api-for-apache-cassandra-5.0, tez, flyway, wildfly, opensearch, apache-pulsar, thingsboard, infinispan, spark, keycloak, docker-selenium...

GHSA-HVCG-QMG6-JM4C vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator, neo4j, logstash, druid, management-api-for-apache-cassandra-5.0, tez, flyway, wildfly, opensearch, apache-pulsar, thingsboard, infinispan, spark, keycloak, docker-selenium...

GHSA-X4GW-5CX5-PGMH vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, druid, tez, thingsboard, spark, zookeeper, docker-selenium, apache-nifi-registry, zipkin, apache-nifi, apache-pulsar, apache-activemq-artemis, infinispan, selenium, kserve-modelmesh, neo4j, cassandra, management-api-for-apache-cassandra-5.0,...

CVE-2026-45416 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, druid, tez, thingsboard, spark, zookeeper, docker-selenium, apache-nifi-registry, zipkin, apache-nifi, apache-pulsar, apache-activemq-artemis, infinispan, selenium, kserve-modelmesh, neo4j, cassandra, management-api-for-apache-cassandra-5.0,...