Red Hat Red Hat 3scale API Management Platform 2
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-92925 | | Redis: redis: out-of-bounds read via crafted cluster bus packets | HIGH 7.1 | 0.7 % | ||
| CVE-2024-12125 | | 3scale-porta: readonly fields not validated server-side | HIGH 7.5 | 0.3 % | ||
| CVE-2025-49794 | | Libxml: heap use after free (uaf) leads to denial of service (dos) | CRITICAL 9.1 | 0.8 % | ||
| CVE-2024-11831 | | Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript | MEDIUM 5.4 | 1.1 % | ||
| CVE-2024-10295 | | Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to … | HIGH 7.5 | 0.4 % | ||
| CVE-2024-9671 | | System: pdf invoices of the developer users can be seen if the url is known | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-0560 | | Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions | MEDIUM 6.3 | 0.5 % | ||
| CVE-2023-4910 | | 3scale-admin-portal: logged out users tokens can be accessed | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-5349 | | Draw while calling getdrawinfo() | MEDIUM 5.3 | 0.7 % | ||
| CVE-2023-0456 | | Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check | HIGH 7.5 | 0.6 % |