PT-2026-70055

Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description A flaw allows a remote attacker with 'deployer' account authentication to import and deploy a malicious archive file from an untrusted source. By leveraging WildFly libraries to create a...

PT-2026-70241

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

PT-2026-70096

Name of the Vulnerable Software and Affected Versions Wildfly affected versions not specified Description A remote unauthenticated attacker can trigger an OutOfMemoryError. This occurs because the GSS token decoder in CSIv2Util reads a length field controlled by the attacker without performing...

Linux Distros Unpatched Vulnerability : CVE-2026-14180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue...

CVE-2026-17614

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CVE-2026-17614 Wildfly-core: path traversal on wildfly domain controller

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CVE-2026-17614

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

EUVD-2026-52568

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CVE-2026-17614

CVE-2026-17614 affects WildFly-core in domain mode. The LocalFileRepository.getFile() and getConfigurationFile() do not ensure that resolved paths stay within the configured repository or configuration root, enabling a path traversal via crafted relative paths (e.g., ../../etc/passwd) sent throug...

CVE-2026-17614

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

CLEANSTART-2026-CN74115 Security fixes in wildfly 40.0.1-r1

Package wildfly version 40.0.1-r1 fixes 14 vulnerabilities: ghsa-3qp7-7mw8-wx86, ghsa-x4gw-5cx5-pgmh, ghsa-c653-97m9-rcg9, CVE-2026-44249, CVE-2026-45416...

CLEANSTART-2026-JU83352 Security fixes in wildfly 40.0.1-r2

Package wildfly version 40.0.1-r2 fixes 2 vulnerabilities: ghsa-5jmj-h7xm-6q6v, CVE-2026-54515...

CVE-2026-41939

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

CVE-2026-41939 Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

EUVD-2026-50439

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

CVE-2026-41939

Summary: CVE-2026-41939 affects Care Everywhere Gateway 14.3.10, where a hard-coded credential flaw in the bundled WildFly 8.2.0.Final management interface enables unauthenticated remote access to the WildFly admin console (port 20990) with default credentials. This allows deployment of a malicio...

PT-2026-65863

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: debezium, opensearch, apicurio-registry, debezium-connector-informix, debezium-connector-vitess, apache-pulsar, debezium-connector-db2, cassandra-reaper, debezium-connector-ibmi, druid, strimzi-kafka-operator, sonarqube, wildfly, logstash, kafka, confluent-kafka,...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: debezium, opensearch, apicurio-registry, debezium-connector-informix, debezium-connector-vitess, apache-pulsar, debezium-connector-db2, cassandra-reaper, debezium-connector-ibmi, druid, strimzi-kafka-operator, sonarqube, wildfly, logstash, kafka, confluent-kafka,...

CLEANSTART-2026-FZ22182 Security fixes for CVE-2026-0636, CVE-2026-3260, CVE-2026-33558, CVE-2026-33870, CVE-2026-33871, CVE-2026-3505, CVE-2026-35554, CVE-2026-41417, CVE-2026-42402, CVE-2026-42403, CVE-2026-42404, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-5588, CVE-2026-5598, ghsa-287c-fxr7-3w6c, ghsa-2hfh-9h53-qc24, ghsa-38f8-5428-x5cv, ghsa-45q3-82m4-75jr, ghsa-57rv-r2g8-2cj3, ghsa-5qcv-4rpc-jp93, ghsa-72hv-8253-57qq, ghsa-c3fc-8qff-9hwx, ghsa-cj8j-37rh-8475, ghsa-cm33-6792-r9fm, ghsa-f6hv-jmp6-3vwv, ghsa-g36m-9g3m-2vmp, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-v8h7-rr48-vmmv, ghsa-w9fj-cfpg-grvv, ghsa-wf66-mphr-4c4r, ghsa-wg6q-6289-32hp, ghsa-xxqh-mfjm-7mv9 applied in versions: 39.0.1-r0

Multiple security vulnerabilities affect the wildfly package. These issues are resolved in later releases. See references for individual vulnerability details...