Skip to content
Noroxi

Quarkus records

54 published records for vendor quarkus.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
94.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

54 records
  • CVE-2022-4116
    49Plan

    A vulnerability was found in quarkus.

    CriticalCVSS 9.8No exploitEPSS 32%

    quarkus · quarkusNov 22, 2022

  • CVE-2022-21724
    40Plan

    Unchecked Class Instantiation when providing Plugin Classes

    CriticalCVSS 9.8No exploitEPSS 3%

    postgresql · postgresql jdbc driverFeb 2, 2022

  • CVE-2022-2466
    40Plan

    It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    quarkus · quarkusAug 31, 2022

  • CVE-2021-26291
    39Monitor

    block repositories using http by default

    CriticalCVSS 9.1Proof of conceptEPSS 8%

    apache · mavenApr 23, 2021

  • CVE-2023-6267
    39Monitor

    Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

    CriticalCVSS 9.8No exploitEPSS 0%

    quarkus · quarkusJan 25, 2024

  • CVE-2017-18640
    38Monitor

    The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

    HighCVSS 7.5No exploitEPSS 26%

    snakeyaml project · snakeyamlDec 11, 2019

  • CVE-2025-14813
    37Monitor

    GOSTCTR implementation unable to process more than 255 blocks correctly

    CriticalCVSS 9.3No exploitEPSS 0%

    legion of the bouncy castle inc. · bc-javaApr 15, 2026

  • CVE-2020-1714
    36Monitor

    A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.

    HighCVSS 8.8No exploitEPSS 2%

    redhat · keycloakMay 13, 2020

  • CVE-2023-6394
    36Monitor

    Quarkus: graphql operations over websockets bypass

    CriticalCVSS 9.1No exploitEPSS 0%

    quarkus · quarkusDec 9, 2023

  • CVE-2024-12225
    36Monitor

    Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass

    CriticalCVSS 9.1No exploitEPSS 0%

    quarkus · quarkusMay 6, 2025

  • CVE-2020-25649
    35Monitor

    A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

    HighCVSS 7.5No exploitEPSS 17%

    fasterxml · jackson-databindDec 3, 2020

  • CVE-2022-0981
    35Monitor

    A flaw was found in Quarkus.

    HighCVSS 8.8No exploitEPSS 1%

    quarkus · quarkusMar 23, 2022

  • CVE-2026-5598
    35Monitor

    Non-constant time comparisons risk private key leakage in FrodoKEM.

    HighCVSS 8.9No exploitEPSS 0%

    legion of the bouncy castle inc. · bc-javaApr 15, 2026

  • CVE-2026-39852
    35Monitor

    Quarkus authorization bypass via semicolon path normalization inconsistency

    HighCVSS 8.8No exploitEPSS 0%

    quarkus · quarkusMay 5, 2026

  • CVE-2023-4853
    33Monitor

    Quarkus: http security policy bypass

    HighCVSS 8.1No exploitEPSS 2%

    quarkus · quarkusSep 20, 2023

  • CVE-2021-37714
    32Monitor

    Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

    HighCVSS 7.5No exploitEPSS 6%

    jsoup · jsoupAug 18, 2021

  • CVE-2021-37137
    32Monitor

    The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

    HighCVSS 7.5No exploitEPSS 6%

    netty · nettyOct 19, 2021

  • CVE-2021-37136
    32Monitor

    The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati

    HighCVSS 7.5No exploitEPSS 5%

    netty · nettyOct 19, 2021

  • CVE-2020-13692
    31Monitor

    PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

    HighCVSS 7.7No exploitEPSS 4%

    postgresql · postgresql jdbc driverJun 4, 2020

  • CVE-2022-42003
    31Monitor

    In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitiv

    HighCVSS 7.5No exploitEPSS 3%

    fasterxml · jackson-databindOct 2, 2022

  • CVE-2022-42004
    31Monitor

    In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFrom

    HighCVSS 7.5No exploitEPSS 3%

    fasterxml · jackson-databindOct 2, 2022

  • CVE-2020-28491
    31Monitor

    Denial of Service (DoS)

    HighCVSS 7.5No exploitEPSS 2%

    fasterxml · jackson-dataformats-binaryFeb 18, 2021

  • CVE-2021-29428
    31Monitor

    Local privilege escalation through system temporary directory

    HighCVSS 7.8No exploitEPSS 0%

    gradle · gradleApr 13, 2021

  • CVE-2020-25638
    30Monitor

    A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.

    HighCVSS 7.4No exploitEPSS 2%

    hibernate · hibernate ormDec 2, 2020

  • CVE-2026-50559
    30Monitor

    Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

    HighCVSS 7.5No exploitEPSS 1%

    quarkus · quarkusJun 19, 2026