Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-41713
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
HIGH
CVE-2026-41712
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
CRITICAL
CVE-2026-27478
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
HIGH
CVE-2026-41705
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
HIGH
CVE-2026-39816
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
CRITICAL
CVE-2026-40982
Spring Cloud Config vulnerable to Path Traversal
HIGH
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CRITICAL
CVE-2026-42555
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
CRITICAL
CVE-2026-40010
Apache Wicket has a Session Fixation issue
CRITICAL
CVE-2026-44221
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
CRITICAL
CVE-2026-7411
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
HIGH
CVE-2026-7412
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
CRITICAL
CVE-2026-41901
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
CRITICAL
CVE-2026-41258
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
CRITICAL
CVE-2026-42809
Apache Polaris has an Improper Input Validation Issue
CRITICAL
CVE-2026-42027
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
CRITICAL
CVE-2026-42811
Apache Polaris has an Improper Input Validation issue
CRITICAL
CVE-2026-42810
Apache Polaris has an Improper Input Validation Issue
CRITICAL
CVE-2026-42812
Apache Polaris has an Improper Input Validation issue
CRITICAL
CVE-2026-40682
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
CRITICAL
CVE-2026-40076
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
HIGH
CVE-2026-39852
Quarkus has Authentication/Authorization bypasses
CRITICAL
CVE-2026-42778
Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)
CRITICAL
CVE-2026-42779
Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)
CRITICAL
CVE-2026-36767
Shopizer has a path traversal issue
CRITICAL
CVE-2026-41586
fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE
CRITICAL
CVE-2026-42523
Jenkins GitHub Plugin has an XSS vulnerability
HIGH
CVE-2026-40978
Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()
HIGH
CVE-2026-40967
Spring AI has a VectorStore FilterExpression Converter injection
CRITICAL
CVE-2026-40976
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
HIGH
CVE-2026-40022
Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel
CRITICAL
CVE-2026-33454
Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
HIGH
CVE-2026-40858
Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2026-33453
Apache camel-coap allows header injection that can lead to remote code execution
CRITICAL
CVE-2026-41409
Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)
CRITICAL
CVE-2026-41635
Apache MINA vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2026-40453
Apache Camel has an incomplete fix for CVE-2025-27636
CRITICAL
CVE-2026-40860
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
HIGH
CVE-2026-40473
Camel-MINA Vulnerable to Deserialization of Untrusted Data
HIGH
CVE-2026-41044
Apache ActiveMQ Vulnerable to Code Injection
HIGH
CVE-2026-40466
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
CRITICAL
CVE-2026-32613
Spinnaker: RCE via expression parsing due to unrestricted context handling
CRITICAL
CVE-2026-32604
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
CRITICAL
CVE-2026-33557
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
CRITICAL
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
HIGH
CVE-2026-3505
Bouncy Castle Uncontrolled Resource Consumption vulnerability
HIGH
CVE-2026-5598
Bouncy Castle Has Covert Timing Channel Vulnerability
HIGH
CVE-2026-41883
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
CRITICAL
CVE-2026-40478
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
CRITICAL
CVE-2026-40477
Improper restriction of the scope of accessible objects in Thymeleaf expressions