Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-29514
XWiki vulnerable to Code Injection in template provider administration
CRITICAL
CVE-2023-29512
xwiki-platform-web-templates vulnerable to Eval Injection
CRITICAL
CVE-2023-20873
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
CRITICAL
CVE-2023-29926
PowerJob vulnerable to remote code execution
CRITICAL
CVE-2023-29510
Code injection via unescaped translations in xwiki-platform
CRITICAL
CVE-2023-24831
Apache IoTDB Grafana Connector vulnerable to Improper Authentication
CRITICAL
CVE-2023-22946
Apache Spark vulnerable to Improper Privilege Management
HIGH
CVE-2023-29207
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
CRITICAL
CVE-2023-29205
org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
CRITICAL
CVE-2023-29511
xwiki-platform-administration-ui vulnerable to privilege escalation
CRITICAL
CVE-2023-30537
org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation
CRITICAL
CVE-2023-29509
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29214
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29212
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29211
org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
CRITICAL
CVE-2023-29210
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29209
org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
CRITICAL
CVE-2023-29215
Apache Linkis JDBC EngineConn has deserialization vulnerability
CRITICAL
CVE-2023-29216
Apache Linkis DatasourceManager module has deserialization vulnerability
CRITICAL
CVE-2023-25330
MyBatis-Plus vulnerable to SQL injection via TenantPlugin
CRITICAL
CVE-2020-20913
Ming-Soft MCMS vulnerable to SQL injection
CRITICAL
CVE-2023-1784
jeecg-boot vulnerable to improper authentication
CRITICAL
CVE-2023-28462
Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed
CRITICAL
CVE-2023-28326
Apache OpenMeetings missing authentication and can allow user impersonation
CRITICAL
CVE-2023-20860
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
CRITICAL
CVE-2023-27479
org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection
CRITICAL
CVE-2023-23638
Apache Dubbo vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-26477
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-26471
XWiki Platform users may execute anything with superadmin right through comments and async macro
CRITICAL
CVE-2023-26055
XWiki Platform may allow privilege escalation to programming rights via user's first name
CRITICAL
CVE-2023-26472
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
CRITICAL
CVE-2023-26474
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CRITICAL
CVE-2023-26475
xwiki-platform vulnerable to Remote Code Execution in Annotations
CRITICAL
CVE-2022-4492
Undertow client not checking server identity presented by server certificate in https connections
CRITICAL
CVE-2023-25158
GeoTools OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25157
GeoServer OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25613
Apache Kerby LdapIdentityBackend LDAP Injection vulnerability
CRITICAL
CVE-2014-125087
java-xmlbuilder vulnerable to XML External Entity Reference
CRITICAL
CVE-2023-25765
Sandbox escape in Jenkins Email Extension Plugin
CRITICAL
CVE-2022-4903
CodenameOne Pending Intent vulnerability
CRITICAL
CVE-2023-24997
Apache InLong vulnerable to Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2023-24163
Dromara hutool vulnerable to SQL Injection
CRITICAL
CVE-2023-24162
Dromara Hutool Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2022-25894
Remote Code Execution in com.bstek.uflo:uflo-core
CRITICAL
CVE-2023-24441
XML external entity vulnerability on agents in Jenkins MSTest Plugin
CRITICAL
CVE-2023-24456
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
CRITICAL
CVE-2023-24443
XML Entity Expansion in Jenkins TestComplete support Plugin
CRITICAL
CVE-2023-24430
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24429
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24427
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin