CVE Program partner

Payara

Payara

API
CVEs, 365 days310 all time, 1 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationPayara
RoleCNA
TypeOpen Source, Vendor
Reports tomitre
ScopeAll Payara Platform product distributions (Payara Server, Micro, Embedded) for both Enterprise (commercial) and Community (OSS) distributions.
Advisorieshttps://docs.payara.fish/community/docs/Security/Security%20Fix%20List.html

Latest CVEs · RSS

  • CVE-2026-92082 2026-09-15 · CVSS 6.3
    By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Paya
  • CVE-2026-12986 2026-06-24 · CVSS 7.3
    A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak t
  • CVE-2025-14340 2026-02-18 · CVSS 7.3
    Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to
  • CVE-2025-1534 2025-04-01 · CVSS 6.8
    CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code
  • CVE-2024-45687 2025-01-21 · CVSS 2.4
    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Mana
  • CVE-2024-8215 2024-10-08 · CVSS 8.7
    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console module
  • CVE-2024-8097 2024-09-11 · CVSS 6.7
    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted
  • CVE-2024-7312 2024-09-11 · CVSS 7.0
    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.
  • CVE-2023-41699 2023-11-15 · CVSS 6.1
    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows R

All CVE Program partners