Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-22965KEV
Remote Code Execution in Spring Framework
CRITICAL
CVE-2022-22947KEV
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
HIGH
CVE-2020-11969
Missing Authentication for Critical Function in Apache TomEE
CRITICAL
CVE-2021-43297
Deserialization of Untrusted Data in Dubbo
HIGH
CVE-2021-22569
A potential Denial of Service issue in protobuf-java
MEDIUM
CVE-2021-44832EPSS 53.6%
Improper Input Validation and Injection in Apache Log4j2
HIGH
CVE-2021-45105EPSS 71.4%
Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion
CRITICAL
CVE-2021-45046KEVEPSS 94.3%
Incomplete fix for Apache Log4j vulnerability
CRITICAL
CVE-2021-44228KEVEPSS 94.4%
Remote code injection in Log4j
CRITICAL
CVE-2021-40865
Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
CRITICAL
CVE-2021-38294
Command injection leading to Remote Code Execution in Apache Storm
MEDIUM
CVE-2021-41183
XSS in `*Text` options of the Datepicker widget in jquery-ui
MEDIUM
CVE-2021-41184
XSS in the `of` option of the `.position()` util in jquery-ui
MEDIUM
CVE-2021-41182
XSS in the `altField` option of the Datepicker widget in jquery-ui
HIGH
CVE-2021-41084
Response Splitting from unsanitized headers
CRITICAL
CVE-2021-39185
Default CORS config allows any origin with credentials
CRITICAL
CVE-2020-5413
Code execution in Spring Integration
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-11022
Potential XSS vulnerability in jQuery
CRITICAL
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind
CRITICAL
CVE-2019-20330
Deserialization of Untrusted Data in jackson-databind
MEDIUM
CVE-2019-11358
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
MEDIUM
CVE-2019-8331
Bootstrap Vulnerable to Cross-Site Scripting
CRITICAL
CVE-2019-3773
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
MEDIUM
CVE-2018-20677
bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-20676
XSS vulnerability that affects bootstrap
MEDIUM
CVE-2016-10735
Bootstrap Cross-site Scripting vulnerability
CRITICAL
CVE-2018-14721
Server-Side Request Forgery (SSRF) in jackson-databind
CRITICAL
CVE-2018-19362
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2018-14718
Arbitrary Code Execution in jackson-databind
CRITICAL
CVE-2018-1260
Spring Security OAuth vulnerable to remote code execution (RCE)
CRITICAL
CVE-2017-15095
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
CRITICAL
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
CRITICAL
CVE-2018-7489
FasterXML jackson-databind allows unauthenticated remote code execution
MEDIUM
CVE-2018-14042
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-14041
Bootstrap Cross-site Scripting vulnerability
HIGH
CVE-2016-10707
Denial of Service in jquery
MEDIUM
CVE-2016-7103
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText