payara
Security Risk Profile
66
/100
highSecurity Risk Score
Comprehensive risk assessment based on 12 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from September 23, 2021 to present
12
Total CVEs
8
Critical+High
0
Exploited
5
Unpatched
Threat Assessment
Avg CVSS
7.1
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
5
Critical/High
Risk Level
66/100
high
Severity Distribution
Critical
1High
7Medium
3Low
1Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
3Age Distribution
Common Weaknesses (CWE)
1
XSS
3
2
Path Traversal
2
3
CSRF
1
4
SSRF
1
5
Infoleak
1
Most Affected Products
1. Payara Payara24
2. Payara Payara Server10
3. Payara Payara Server Full1
4. Payara Payara Micro1
5. maven/fish.payara.server:payara-aggregator1
Recent Vulnerabilities
See more →CVE-2026-12986
CVSS 7.3high
6/24/2026🔧 No Patch
CVE-2025-14340
CVSS 7.3high
Admin Account Takeover via malicious URL payload
2/18/2026
CVE-2025-1534
CVSS 6.8medium
Cross-site Scripting (Stored)
4/1/2025🔧 No Patch
CVE-2024-45687
CVSS 2.4low
HTTP Server incorrectly accepting disallowed characters within header values
1/21/2025🔧 No Patch
CVE-2024-8215
CVSS 8.7EPSS 0%high
Payload Injection Attack via Management REST interface
10/8/2024🔧 No Patch
CVE-2024-8097
CVSS 6.7EPSS 0%medium
Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level
9/11/2024🔧 No Patch
CVE-2024-7312
CVSS 7.0EPSS 0%high
REST Interface Link Redirection via Host parameter
9/11/2024🔧 No Patch
CVE-2023-41699
CVSS 6.1medium
Payara Platform: URL Redirection to untrusted site using FORM authentication
11/15/2023🔧 No Patch
CVE-2023-28462
CVSS 9.8critical
3/30/2023
CVE-2022-45129
CVSS 7.5high
11/10/2022
Monitor payara in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.