IBM Enterprise Build Of Quarkus vulnerabilities

4 CVEs affecting IBM Enterprise Build Of Quarkus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77874, published 2026-09-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16308, published 2026-07-30. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of…
CVE-2026-77874, published 2026-09-24. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements,…
CVE-2026-19651, published 2026-09-08. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of…
CVE-2026-19625, published 2026-09-08. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured…