Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2017-1000245
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
CRITICAL
CVE-2015-8103
Jenkins CLI Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2015-5254
Improper Input Validation in Apache ActiveMQ
CRITICAL
CVE-2015-3253
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
CRITICAL
CVE-2016-4000
Deserialization of Untrusted Data in Jython
CRITICAL
CVE-2015-7501
Deserialization of Untrusted Data in Apache commons collections
CRITICAL
CVE-2016-5019
Apache MyFaces Trinidad Deserialization Vulnerability
CRITICAL
CVE-2016-6814
Deserialization of Untrusted Data in Groovy
CRITICAL
CVE-2017-5648
Exposure of Resource to Wrong Sphere in Apache Tomcat
CRITICAL
CVE-2016-8735KEV
Apache Tomcat Improper Access Control vulnerability
CRITICAL
CVE-2016-6637
Cloud Foundry vulnerable to Cross-Site Request Forgery
CRITICAL
CVE-2017-4992
Cloud Foundry UAA privilege escalation with user invitations
CRITICAL
CVE-2017-8046
Remote code execution in PATCH requests in Spring Data REST
CRITICAL
CVE-2016-5018
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
CRITICAL
CVE-2017-5641
Apache Flex BlazeDS unsafe deserialization
CRITICAL
CVE-2017-1000353KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2018-1000861KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2012-0391KEV
Apache Struts Remote Java Code Execution
CRITICAL
CVE-2009-3555
Apache Tomcat affected by vulnerability in TLS and SSL protocol
CRITICAL
CVE-2022-26612
Path traversal in Hadoop
CRITICAL
CVE-2022-22965KEV
Remote Code Execution in Spring Framework
CRITICAL
CVE-2022-22947KEV
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
CRITICAL
CVE-2021-43297
Deserialization of Untrusted Data in Dubbo
CRITICAL
CVE-2021-45046KEVEPSS 94.3%
Incomplete fix for Apache Log4j vulnerability
CRITICAL
CVE-2021-44228KEVEPSS 94.4%
Remote code injection in Log4j
CRITICAL
CVE-2021-40865
Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
CRITICAL
CVE-2021-38294
Command injection leading to Remote Code Execution in Apache Storm
CRITICAL
CVE-2021-39185
Default CORS config allows any origin with credentials
CRITICAL
CVE-2020-5413
Code execution in Spring Integration
CRITICAL
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind
CRITICAL
CVE-2019-20330
Deserialization of Untrusted Data in jackson-databind
CRITICAL
CVE-2019-3773
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
CRITICAL
CVE-2018-14721
Server-Side Request Forgery (SSRF) in jackson-databind
CRITICAL
CVE-2018-19362
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2018-14718
Arbitrary Code Execution in jackson-databind
CRITICAL
CVE-2018-1260
Spring Security OAuth vulnerable to remote code execution (RCE)
CRITICAL
CVE-2017-15095
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
CRITICAL
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
CRITICAL
CVE-2018-7489
FasterXML jackson-databind allows unauthenticated remote code execution