fish.payara.distributions vulnerabilities

Products

• fish.payara.distributions/payara 2

Latest fish.payara.distributions CVEs

Newest publication first

1. CVE-2026-12986 Payara Server Full has a Cross-Site Request Forgery vulnerability

   Published 2026-06-24

   High·CVSS 7.3 EPSS 0.27%

   A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin d...

2. CVE-2022-45129 Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF

   Published 2022-11-10

   High·CVSS 7.5 EPSS 1.9%

   Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platfor...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.