Payara

9 CVEs across 4 Payara products. Browse Payara vulnerabilities, severities, and proof-of-concept exploits.

Payara products with known CVEs

ProductCVEs
Payara6
Micro Community1
Payara Server1
Payara Server1
Payara CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-129862026-06-24A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak…
CVE-2025-1534Medium5.42025-04-01CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Cod…
CVE-2024-8215High8.42024-10-08Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modul…
CVE-2024-7312Medium6.12024-09-11URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking…
CVE-2023-41699Medium6.12023-11-15URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows…
CVE-2023-28462Critical9.82023-03-30A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community)…
CVE-2022-45129High7.52022-11-10Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. Thi…
CVE-2022-37422High7.52022-08-18Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.
CVE-2021-41381High7.52021-09-23Payara Micro Community 5.2021.6 and below allows Directory Traversal.