Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-37462
org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability
CRITICAL
CVE-2023-30429
Apache Pulsar Incorrect Authorization vulnerability
CRITICAL
CVE-2023-37582
RocketMQ NameServer component Code Injection vulnerability
CRITICAL
CVE-2023-37277
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
HIGH
CVE-2023-1428
gRPC Reachable Assertion issue
CRITICAL
CVE-2023-33246KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
CRITICAL
CVE-2023-31065
Apache InLong Insufficient Session Expiration vulnerability
CRITICAL
CVE-2023-31062
Apache InLong Improper Privilege Management vulnerability
CRITICAL
CVE-2023-31098
Apache InLong has Weak Password Requirements in Apache InLong
CRITICAL
CVE-2022-45802
Apache StreamPark Path Traversal vulnerability
CRITICAL
CVE-2023-26119
HtmlUnit Code Injection vulnerability
CRITICAL
CVE-2023-27603
Apache Linkis Zip Slip issue
CRITICAL
CVE-2023-27602
Apache Linkis Unrestricted File Upload vulnerability
CRITICAL
CVE-2022-24697
Apache Kylin vulnerable to remote code execution
HIGH
CVE-2023-32731
Connection confusion in gRPC
CRITICAL
CVE-2023-36812
Remote Code Execution for 2.4.1 and earlier
CRITICAL
CVE-2023-36468
Upgrading doesn't prevent exploiting vulnerable XWiki documents
CRITICAL
CVE-2023-36469
XWiki Platform vulnerable to Code injection through NotificationRSSService
CRITICAL
CVE-2023-36470
XWiki Platform vulnerable to Code Injection in icon themes
CRITICAL
CVE-2022-4361
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
CRITICAL
CVE-2021-31635
jFinal Server-Side Template Injection vulnerability
CRITICAL
CVE-2023-35161
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
CRITICAL
CVE-2023-35160
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
CRITICAL
CVE-2023-35159
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
CRITICAL
CVE-2023-35158
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
CRITICAL
CVE-2023-35156
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
CRITICAL
CVE-2023-34340
Apache Accumulo Improper Authentication vulnerability
CRITICAL
CVE-2023-35162
XWiki Platform vulnerable to cross-site scripting via xcontinue parameter in previewactions template
CRITICAL
CVE-2023-35152
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
CRITICAL
CVE-2023-35150
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
CRITICAL
CVE-2023-34465
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
CRITICAL
CVE-2023-34464
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
CRITICAL
CVE-2023-35839
Solon vulnerable to deserialization of untrusted data
CRITICAL
CVE-2023-34659
jeecg-boot SQL injection vulnerability
CRITICAL
CVE-2023-35042
GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
CRITICAL
CVE-2023-33496
xxl-rpc deserialization vulnerability
CRITICAL
CVE-2023-31890
glazedlists XML Deserialization vulnerability
CRITICAL
CVE-2022-47937
Apache Sling Commons JSON bundle vulnerable to Improper Input Validation
CRITICAL
CVE-2023-32070
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
CRITICAL
CVE-2023-32069
Privilege escalation (PR)/RCE from account through class sheet
CRITICAL
CVE-2023-30331
Server-side template injection in beetl
CRITICAL
CVE-2023-25826
Command injection in OpenTSDB
CRITICAL
CVE-2023-30349
Remote code execution in JFinal CMS
CRITICAL
CVE-2023-29924
PowerJob vulnerable to incorrect access control
CRITICAL
CVE-2023-29525
XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration
CRITICAL
CVE-2023-29527
XWiki Platform vulnerable to code injection from account through AWM view sheet
CRITICAL
CVE-2023-29526
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
CRITICAL
CVE-2023-29524
XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet
CRITICAL
CVE-2023-29523
XWiki Platform vulnerable to code injection in display method used in user profiles
CRITICAL
CVE-2023-29516
XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector