Known vulnerabilities in Red Hat Fuse 7

Is your version affected?

CVE	Summary	Score	Published
CVE-2026-40976	In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…	9.1 Critical	Apr 27, 2026
CVE-2026-40478	Thymeleaf is a server-side Java template engine for web and standalone environments	9.1 Critical	Apr 17, 2026
CVE-2026-40477	Thymeleaf is a server-side Java template engine for web and standalone environments	9.1 Critical	Apr 17, 2026
CVE-2025-14813	: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc	9.3 Critical	Apr 15, 2026
CVE-2026-27446	Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis	9.3 Critical	Mar 4, 2026
CVE-2026-1615	Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of…	9.8 Critical	Feb 9, 2026
CVE-2025-61140	The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution	9.8 Critical	Jan 28, 2026
CVE-2025-61686	React Router is a router for React	9.1 Critical	Jan 10, 2026
CVE-2025-70974	Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key…	10.0 Critical	Jan 9, 2026
CVE-2025-12543	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf	9.6 Critical	Jan 7, 2026