Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
CRITICAL
CVE-2026-39006
SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component
CRITICAL
CVE-2026-50632
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
CRITICAL
CVE-2026-50633
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
CRITICAL
CVE-2026-50627
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
CRITICAL
CVE-2026-50628
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
CRITICAL
CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2026-50076
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
CRITICAL
CVE-2026-47065
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass
CRITICAL
CVE-2026-46621
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
CRITICAL
CVE-2026-46562
Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override
CRITICAL
CVE-2026-44632
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
CRITICAL
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CRITICAL
CVE-2026-23734
XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash
CRITICAL
CVE-2026-44930
Apache CXF has an LDAP injection vulnerability
CRITICAL
CVE-2026-2587
GlassFish's gadget handler is vulnerable to RCE
CRITICAL
CVE-2026-2586
GlassFish's Administration Console is Vulnerable to RCE
CRITICAL
CVE-2026-47323
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
CRITICAL
CVE-2026-45083
Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy
CRITICAL
CVE-2026-44672
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
CRITICAL
CVE-2026-33117
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
CRITICAL
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied
CRITICAL
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user
CRITICAL
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated
CRITICAL
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
CRITICAL
CVE-2026-27478
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
CRITICAL
CVE-2026-40982
Spring Cloud Config vulnerable to Path Traversal
CRITICAL
CVE-2026-42555
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
CRITICAL
CVE-2026-40010
Apache Wicket has a Session Fixation issue
CRITICAL
CVE-2026-44221
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
CRITICAL
CVE-2026-7411
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
CRITICAL
CVE-2026-41901
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
CRITICAL
CVE-2026-41258
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
CRITICAL
CVE-2026-42809
Apache Polaris has an Improper Input Validation Issue
CRITICAL
CVE-2026-42027
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
CRITICAL
CVE-2026-42811
Apache Polaris has an Improper Input Validation issue
CRITICAL
CVE-2026-42810
Apache Polaris has an Improper Input Validation Issue
CRITICAL
CVE-2026-42812
Apache Polaris has an Improper Input Validation issue
CRITICAL
CVE-2026-40682
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
CRITICAL
CVE-2026-40076
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
CRITICAL
CVE-2026-42778
Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)
CRITICAL
CVE-2026-42779
Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)
CRITICAL
CVE-2026-36767
Shopizer has a path traversal issue
CRITICAL
CVE-2026-41586
fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE
CRITICAL
CVE-2026-42523
Jenkins GitHub Plugin has an XSS vulnerability
CRITICAL
CVE-2026-40976
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
CRITICAL
CVE-2026-33454
Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
CRITICAL
CVE-2026-33453
Apache camel-coap allows header injection that can lead to remote code execution
CRITICAL
CVE-2026-41409
Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)
CRITICAL
CVE-2026-41635
Apache MINA vulnerable to Deserialization of Untrusted Data