Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-40453
Apache Camel has an incomplete fix for CVE-2025-27636
CRITICAL
CVE-2026-40860
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
CRITICAL
CVE-2026-32613
Spinnaker: RCE via expression parsing due to unrestricted context handling
CRITICAL
CVE-2026-32604
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
CRITICAL
CVE-2026-33557
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
CRITICAL
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
CRITICAL
CVE-2026-40478
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
CRITICAL
CVE-2026-40477
Improper restriction of the scope of accessible objects in Thymeleaf expressions
CRITICAL
CVE-2026-39842
Expression Injection in OpenRemote
CRITICAL
CVE-2026-29145
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
CRITICAL
CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
CRITICAL
CVE-2026-33439
OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
CRITICAL
CVE-2026-34361
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
CRITICAL
CVE-2026-22738
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
CRITICAL
CVE-2026-33728
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
CRITICAL
CVE-2026-33701
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
CRITICAL
CVE-2026-22732
Spring Security HTTP Headers Are not Written Under Some Conditions
CRITICAL
CVE-2026-33180
HAPI FHIR HTTP authentication leak in redirects
CRITICAL
CVE-2026-25534
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
CRITICAL
CVE-2026-24713
Apache IoTDB has an Improper Input Validation vulnerability
CRITICAL
CVE-2026-24015
Apache IoTDB has an Insecure Default Configuration Vulnerability
CRITICAL
CVE-2026-29000
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
CRITICAL
CVE-2026-27446
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
CRITICAL
CVE-2025-59059
Apache Ranger has a Code Injection vulnerability
CRITICAL
CVE-2026-23552
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
CRITICAL
CVE-2025-13590
carbon-apimgt does not properly restrict uploaded files
CRITICAL
CVE-2026-23906
Apache Druid Vulnerable to Authentication Bypass
CRITICAL
CVE-2026-25526
JinJava Bypass through ForTag leads to Arbitrary Java Execution
CRITICAL
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
CRITICAL
CVE-2016-15057
Apache Continuum vulnerable to Command Injection through Installations REST API
CRITICAL
CVE-2025-65482
XDocReport affected by an XML External Entity (XXE) vulnerability
CRITICAL
CVE-2025-64087
XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability
CRITICAL
CVE-2025-65091
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
CRITICAL
CVE-2025-70974
FASTJSON Includes Functionality from Untrusted Control Sphere
CRITICAL
CVE-2025-12543
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
CRITICAL
CVE-2025-14307
Robocode has an insecure temporary file creation vulnerability in the AutoExtract component
CRITICAL
CVE-2025-14306
Robocode vulnerable to Directory Traversal in recursivelyDelete Method
CRITICAL
CVE-2025-66516
Apache Tika has XXE vulnerability
CRITICAL
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret
CRITICAL
CVE-2025-12383
Eclipse Jersey has a Race Condition
CRITICAL
CVE-2025-56316
MCMS vulnerable SQL injection via the content_title parameter
CRITICAL
CVE-2025-52472
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
CRITICAL
CVE-2025-49594
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
CRITICAL
CVE-2025-6544
H2O affected by a deserialization vulnerability
CRITICAL
CVE-2025-59340
jinjava has Sandbox Bypass via JavaType-Based Deserialization
CRITICAL
CVE-2025-41243
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
CRITICAL
CVE-2025-55748
XWiki configuration files can be accessed through jsx and sx endpoints
CRITICAL
CVE-2025-55747
XWiki configuration files can be accessed through the webjars API
CRITICAL
CVE-2025-58059
Valtimo scripting engine can be used to gain access to sensitive data or resources
CRITICAL
CVE-2025-54988
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF