CVE-2025-12543Critical· 9.6▾ AbyssalPoC availableA flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containi…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.8 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.2%
1.2% → 1.4%
1 GitHub repo
Last analysed / modified upstream
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
build_of_apache_camel < 4.14.4data_grid = 8.0fuse = 7.0.0jboss_enterprise_application_platform >= 8.0, < 8.0.12jboss_enterprise_application_platform >= 8.1.0, < 8.1.3jboss_enterprise_application_platformjboss_enterprise_application_platform = 7.0.0jboss_enterprise_application_platform_expansion_packprocess_automation = 7.0single_sign-on = 7.0undertow < 2.2.39undertow >= 2.3.0, < 2.3.21Upgrade past the affected range:
build_of_apache_camel 4.14.4jboss_enterprise_application_platform 8.1.3undertow 2.3.21Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7507High· 7.5A session fixation vulnerability was found in Keycloak's login-actions endpoints
CVE-2026-7307High· 7.5A flaw was found in Keycloak
CVE-2026-4634High· 7.5A flaw was found in Keycloak
CVE-2026-11819Medium· 5.5Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module retrieves a passphrase from the OS native keyring (GNOME Keyring, macOS Keychain, Windows Credential Manager) and pl…
CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…
CVE-2026-4408Critical· 9.0A flaw was found in Samba