Red Hat JBoss Web Server vulnerabilities

4 CVEs affecting Red Hat JBoss Web Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-34486, published 2026-04-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability, published 2026-04-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-08-04. EPSS: 6.6% chance of exploitation in the next 30 days. Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20,…
CVE-2016-2183, published 2016-09-01. High severity, CVSS 7.5. EPSS: 94.7% chance of exploitation in the next 30 days. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2016-5387, published 2016-07-19. High severity, CVSS 8.1. EPSS: 55.7% chance of exploitation in the next 30 days. The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable,…