Browse CVEs by Ecosystem and Severity

Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Undertow is Vulnerable to HTTP Request/Response Smuggling

Undertow is Vulnerable to HTTP Request/Response Smuggling

Undertow is Vulnerable to HTTP Request/Response Smuggling

Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs

Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

Spring Boot has an Authentication Bypass under Actuator Health groups paths

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

Jenkins has a link following vulnerability allows arbitrary file creation

SQL Injection in Spring AI MariaDBFilterExpressionConverter

JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

Apache Spark: Spark History Server Code Execution Vulnerability

Keycloak SAML Broken has Authentication Bypass by Primary Weakness

XWiki Blog Application home page vulnerable to Stored XSS via Post Title

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Apache Tomcat has an Improper Input Validation vulnerability

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Keycloak affected by improper invitation token validation

Apache Struts 2 is Missing XML Validation

OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE

Apache Kyuubi Server vulnerable to Path Traversal

Apache HugeGraph-Server: RAFT and deserialization vulnerability

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Jenkins Azure CLI Plugin does not restrict the commands it executes

Apache Tomcat Vulnerable to Relative Path Traversal

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

JDBC Driver for SQL Server has improper input validation issue

Apache Kylin Files or Directories Accessible to External Parties

Hutool allows remote code execution (RCE) via the QLExpressEngine class

JasperReports has a Java deserialisation vulnerability

Apache DolphinScheduler vulnerable to Alert Script Attack

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)

hippo4j Includes Hard Coded Secret Key in JWT Creation

Apache Seata: Deserialization of untrusted Data in Apache Seata Server

Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build

Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

PowSyBl Core allows deserialization of untrusted SparseMatrix data

Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler

XWiki does not require right warnings for XClass definitions

XWiki allows remote code execution through preview of XClass changes in AWM editor

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

XWiki's required right warnings for macros are incomplete