Red Hat 3scale API Management vulnerabilities

13 CVEs affecting Red Hat 3scale API Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46625, published 2026-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10216, published 2019-11-27. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by…
CVE-2026-46625, published 2026-06-10. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the…
CVE-2021-20252, published 2021-02-23. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious…
CVE-2022-1414, published 2022-10-19. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive…
CVE-2021-3412, published 2021-06-01. High severity, CVSS 7.3. EPSS: 0.8% chance of exploitation in the next 30 days. It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly…
CVE-2021-3656, published 2022-03-04. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a…
CVE-2020-14388, published 2021-06-02. Medium severity, CVSS 6.3. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal…
CVE-2020-25634, published 2021-05-26. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before…
CVE-2019-14852, published 2021-03-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized…
CVE-2021-3609, published 2022-03-03. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This…

Latest

CVE-2024-10295, published 2024-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing…
CVE-2023-4910, published 2023-11-06. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
CVE-2022-0330, published 2022-03-25. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system…