Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-24057
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
CRITICAL
CVE-2022-47105
Jeecg-boot is vulnerable to SQL injection
CRITICAL
CVE-2018-25068
globalpom-utils has Insecure Temporary File
CRITICAL
CVE-2016-15011
dssp vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2020-36640
bonita-connector-webservice XML External Entity vulnerability
CRITICAL
CVE-2020-36641
aXMLRPC XML External Entity vulnerability
CRITICAL
CVE-2022-45875
Apache DolphinScheduler vulnerable to Improper Input Validation
CRITICAL
CVE-2021-32824
Apache Dubbo vulnerable to remote code execution via Telnet Handler
CRITICAL
CVE-2017-20151
iText RUPS XML External Entity vulnerability
CRITICAL
CVE-2022-44621
Apache Kylin vulnerable to Command injection by Diagnosis Controller
CRITICAL
CVE-2022-4725
AWS SDK is vulnerable to server-side request forgery (SSRF)
CRITICAL
CVE-2022-36437
Hazelcast connection caching
CRITICAL
CVE-2022-45347
Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability
CRITICAL
CVE-2022-40145
Apache Karaf vulnerable to potential code injection
CRITICAL
CVE-2022-46364
Apache CXF Server-Side Request Forgery vulnerability
CRITICAL
CVE-2022-4375
Mingsoft MCMS vulnerable to SQL Injection
HIGH
CVE-2022-23496
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
CRITICAL
CVE-2022-45046
camel-ldap component allows LDAP Injection when using the filter option
CRITICAL
CVE-2022-46366
Apache Tapestry allows deserialization of untrusted data
CRITICAL
CVE-2022-44262
ff4j is vulnerable to Remote Code Execution (RCE)
CRITICAL
CVE-2022-45207
Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString
CRITICAL
CVE-2022-45462
Command injection in Apache DolphinScheduler Alert Plugins
CRITICAL
CVE-2022-4116
Code injection in quarkus dev ui config editor
CRITICAL
CVE-2022-41937
Missing Authorization in Filter Stream Converter Application of XWiki-platform
CRITICAL
CVE-2022-41934
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
CRITICAL
CVE-2022-41931
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
CRITICAL
CVE-2022-41928
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
CRITICAL
CVE-2022-45395
XML External Entity Reference in Jenkins CCCC Plugin
CRITICAL
CVE-2022-45047
Unsafe deserialization in Apache MINA SSHD
CRITICAL
CVE-2022-42122
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
CRITICAL
CVE-2022-42120
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module
CRITICAL
CVE-2022-45378
Apache SOAP contains unauthenticated RPCRouterServlet
CRITICAL
CVE-2022-45136
Apache Jena vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-42920
Apache Commons BCEL vulnerable to out-of-bounds write
CRITICAL
CVE-2022-31692
Spring Security authorization rules can be bypassed via forward or include dispatcher types
CRITICAL
CVE-2022-42468
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
CRITICAL
CVE-2022-43403
Jenkins Script Security Plugin sandbox bypass vulnerability
CRITICAL
CVE-2022-43402
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
CRITICAL
CVE-2022-39198
Hessian Lite for Apache Dubbo deserialization vulnerability
CRITICAL
CVE-2022-42889
Arbitrary code execution in Apache Commons Text
MEDIUM
CVE-2022-3171
protobuf-java has a potential Denial of Service issue
CRITICAL
CVE-2022-36098
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
CRITICAL
CVE-2022-36099
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
CRITICAL
CVE-2022-36100
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
CRITICAL
CVE-2022-37021
Apache Geode vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-25168
Apache Hadoop argument injection vulnerability
CRITICAL
CVE-2022-31183
fs2-io skips mTLS client verification
CRITICAL
CVE-2022-35912
Grails framework Remote Code Execution via Data Binding
CRITICAL
CVE-2016-1000273
Java Melody vulnerable to cross-site scripting
MEDIUM
CVE-2022-31160
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label