Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-4116
Code injection in quarkus dev ui config editor
CRITICAL
CVE-2022-41937
Missing Authorization in Filter Stream Converter Application of XWiki-platform
CRITICAL
CVE-2022-41934
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
CRITICAL
CVE-2022-41931
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
CRITICAL
CVE-2022-41928
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
CRITICAL
CVE-2022-45395
XML External Entity Reference in Jenkins CCCC Plugin
CRITICAL
CVE-2022-45047
Unsafe deserialization in Apache MINA SSHD
CRITICAL
CVE-2022-42122
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
CRITICAL
CVE-2022-42120
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module
CRITICAL
CVE-2022-45378
Apache SOAP contains unauthenticated RPCRouterServlet
CRITICAL
CVE-2022-45136
Apache Jena vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-42920
Apache Commons BCEL vulnerable to out-of-bounds write
CRITICAL
CVE-2022-31692
Spring Security authorization rules can be bypassed via forward or include dispatcher types
CRITICAL
CVE-2022-42468
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
CRITICAL
CVE-2022-43403
Jenkins Script Security Plugin sandbox bypass vulnerability
CRITICAL
CVE-2022-43402
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
CRITICAL
CVE-2022-39198
Hessian Lite for Apache Dubbo deserialization vulnerability
CRITICAL
CVE-2022-42889
Arbitrary code execution in Apache Commons Text
CRITICAL
CVE-2022-36098
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
CRITICAL
CVE-2022-36099
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
CRITICAL
CVE-2022-36100
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
CRITICAL
CVE-2022-37021
Apache Geode vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-25168
Apache Hadoop argument injection vulnerability
CRITICAL
CVE-2022-31183
fs2-io skips mTLS client verification
CRITICAL
CVE-2022-35912
Grails framework Remote Code Execution via Data Binding
CRITICAL
CVE-2016-1000273
Java Melody vulnerable to cross-site scripting
CRITICAL
CVE-2022-31053
Signature forgery in Biscuit
CRITICAL
CVE-2021-37404
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2
CRITICAL
CVE-2020-2300
Improper Authentication (empty password) in Jenkins Active Directory Plugin
CRITICAL
CVE-2020-2301
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
CRITICAL
CVE-2020-2299
Improper Authentication in Jenkins Active Directory Plugin
CRITICAL
CVE-2020-2279
Sandbox bypass vulnerability in Jenkins Script Security Plugin
CRITICAL
CVE-2022-22978
Authorization bypass in Spring Security
CRITICAL
CVE-2014-4172
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
CRITICAL
CVE-2016-3082
Remote Code Execution in Apache Struts
CRITICAL
CVE-2017-7664
Apache OpenMeetings does not correctly validate uploaded XML documents
CRITICAL
CVE-2016-6798
XML External Entity Reference in Apache Sling
CRITICAL
CVE-2017-1000362
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
CRITICAL
CVE-2016-4436
Apache Struts improper action name cleanup
CRITICAL
CVE-2016-3086
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
CRITICAL
CVE-2012-4449
Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop
CRITICAL
CVE-2017-8045
Deserialization of Untrusted Data in Spring AMQP
CRITICAL
CVE-2016-0788
Jenkins allows Execution of Code by Opening a JRMP Listener
CRITICAL
CVE-2014-3600
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
CRITICAL
CVE-2018-1000076
RubyGems Improper Verification of Cryptographic Signature vulnerability
CRITICAL
CVE-2016-9299
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CRITICAL
CVE-2017-12633
Apache Camel camel-hessian component vulnerable to Java object deserialization
CRITICAL
CVE-2016-3087
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
CRITICAL
CVE-2016-4438
Arbitrary code execution in Apache Struts 2
CRITICAL
CVE-2017-5651
Expected Behavior Violation in Apache Tomcat