Red Hat Build Of Apicurio Registry vulnerabilities

3 CVEs affecting Red Hat Build Of Apicurio Registry, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12993, published 2026-06-26.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-12993, published 2026-06-26. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An…
• CVE-2026-12975, published 2026-06-25. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An…
• CVE-2026-12992, published 2026-06-25. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker…