Red Hat Build Of Quarkus 3.27.6.redhat vulnerabilities
6 CVEs affecting Red Hat Build Of Quarkus 3.27.6.redhat, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87744, published 2026-10-12.
More from Red Hat.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2026-89059, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote,…
- CVE-2026-94449, published 2026-09-21. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the…
- CVE-2026-93432, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard…
- CVE-2026-87744, published 2026-10-12. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation…
- CVE-2026-94451, published 2026-10-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by…
- CVE-2026-89058, published 2026-09-18. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with…