Q
Vendor security profile
quarkus
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs20
Critical0
CISA KEV0
Public exploit7
Patch rate%70
Avg. CVSS7.0
12-month vulnerability rate
0
0
1
0
0
0
1
1
0
1
0
0
CVE KEV
CVE severity distribution
20toplam CVE
High13 (65%)
Medium6 (30%)
Low1 (5%)
Patch and exploitation view
%70
Verified patch
%0
CISA KEV
%35
Public exploit
14Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
8.8
CVE-2026-12894
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
Q
Patch status unknownEPSS %0
7.5
CVE-2026-50559
Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Q
Patch verifiedEPSS %1
8.8
CVE-2026-39852
Quarkus authorization bypass via semicolon path normalization inconsistency
Q
Patch verifiedEPSS %1
7.5
CVE-2025-66560
Resource allocation without limits in Quarkus
Q
Patch status unknownEPSS %0
7.4
CVE-2023-6394
Quarkus: graphql operations over websockets bypass
RH
Patch status unknownEPSS %1
8.1
CVE-2023-4853
Quarkus: http security policy bypass
RH
Patch status unknownEPSS %1
7.5
CVE-2022-42003
Deserialization of untrusted data in N/a
N
Patch verifiedEPSS %3
7.5
CVE-2022-42004
Deserialization of untrusted data in N/a
N
Patch verifiedEPSS %3
6.5
CVE-2021-43797
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
N
Patch verifiedEPSS %3
7.5
CVE-2021-37136
Uncontrolled resource consumption in The Netty Project
TN
Patch verifiedEPSS %6