Browse CVEs by Ecosystem and Severity

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

Spring Framework Unsafe Deserialization via Jackson JMS Converters

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Micrometer HTTP server instrumentations DoS

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

CC-Tweaked has an SSRF Protection Bypass with NAT64

Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Apache Flink: Remote code execution via SQL injection in code generation

Apache Tomcat: LockOutRealm treats user names as case-sensitive

Apache Tomcat - WebSocket authentication header exposure

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs

Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

Quarkus has Authentication/Authorization bypasses

Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

Spring AI has a VectorStore FilterExpression Converter injection

Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

Camel-MINA Vulnerable to Deserialization of Untrusted Data

Apache ActiveMQ Vulnerable to Code Injection

Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection

Bouncy Castle Uncontrolled Resource Consumption vulnerability

Bouncy Castle Has Covert Timing Channel Vulnerability

OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

Apache Storm: Deserialization of Untrusted Data vulnerability

Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Apache Tomcat: Configured cipher preference order not preserved

Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator