Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-31053
Signature forgery in Biscuit
CRITICAL
CVE-2021-37404
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2
CRITICAL
CVE-2020-2300
Improper Authentication (empty password) in Jenkins Active Directory Plugin
CRITICAL
CVE-2020-2301
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
CRITICAL
CVE-2020-2299
Improper Authentication in Jenkins Active Directory Plugin
CRITICAL
CVE-2020-2279
Sandbox bypass vulnerability in Jenkins Script Security Plugin
CRITICAL
CVE-2022-22978
Authorization bypass in Spring Security
CRITICAL
CVE-2014-4172
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
CRITICAL
CVE-2016-3082
Remote Code Execution in Apache Struts
CRITICAL
CVE-2017-7664
Apache OpenMeetings does not correctly validate uploaded XML documents
CRITICAL
CVE-2016-6798
XML External Entity Reference in Apache Sling
CRITICAL
CVE-2017-1000362
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
CRITICAL
CVE-2016-4436
Apache Struts improper action name cleanup
CRITICAL
CVE-2016-3086
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
CRITICAL
CVE-2012-4449
Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop
CRITICAL
CVE-2017-8045
Deserialization of Untrusted Data in Spring AMQP
CRITICAL
CVE-2016-0788
Jenkins allows Execution of Code by Opening a JRMP Listener
CRITICAL
CVE-2014-3600
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
CRITICAL
CVE-2018-1000076
RubyGems Improper Verification of Cryptographic Signature vulnerability
HIGH
CVE-2018-1000074
RubyGems Deserialization of Untrusted Data vulnerability
MEDIUM
CVE-2018-1000078
RubyGems Cross-site Scripting vulnerability
CRITICAL
CVE-2016-9299
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CRITICAL
CVE-2017-12633
Apache Camel camel-hessian component vulnerable to Java object deserialization
CRITICAL
CVE-2016-3087
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
CRITICAL
CVE-2016-4438
Arbitrary code execution in Apache Struts 2
HIGH
CVE-2018-1000075
RubyGems Infinite Loop vulnerability
CRITICAL
CVE-2017-5651
Expected Behavior Violation in Apache Tomcat
CRITICAL
CVE-2017-1000245
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
CRITICAL
CVE-2015-8103
Jenkins CLI Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2015-5254
Improper Input Validation in Apache ActiveMQ
CRITICAL
CVE-2015-3253
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
CRITICAL
CVE-2016-4000
Deserialization of Untrusted Data in Jython
CRITICAL
CVE-2015-7501
Deserialization of Untrusted Data in Apache commons collections
CRITICAL
CVE-2016-5019
Apache MyFaces Trinidad Deserialization Vulnerability
CRITICAL
CVE-2016-6814
Deserialization of Untrusted Data in Groovy
CRITICAL
CVE-2017-5648
Exposure of Resource to Wrong Sphere in Apache Tomcat
HIGH
CVE-2018-1000073
RubyGems Link Following vulnerability
CRITICAL
CVE-2016-8735KEV
Apache Tomcat Improper Access Control vulnerability
MEDIUM
CVE-2018-14040
Bootstrap vulnerable to Cross-Site Scripting (XSS)
CRITICAL
CVE-2016-6637
Cloud Foundry vulnerable to Cross-Site Request Forgery
CRITICAL
CVE-2017-4992
Cloud Foundry UAA privilege escalation with user invitations
HIGH
CVE-2015-5237
protobuf susceptible to buffer overflow
CRITICAL
CVE-2017-8046
Remote code execution in PATCH requests in Spring Data REST
CRITICAL
CVE-2016-5018
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
CRITICAL
CVE-2017-5641
Apache Flex BlazeDS unsafe deserialization
CRITICAL
CVE-2017-1000353KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2018-1000861KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2012-0391KEV
Apache Struts Remote Java Code Execution
CRITICAL
CVE-2009-3555
Apache Tomcat affected by vulnerability in TLS and SSL protocol
CRITICAL
CVE-2022-26612
Path traversal in Hadoop