Browse CVEs by Ecosystem and Severity

ExecuTorch integer overflow vulnerability

ExecuTorch heap buffer overflow vulnerability

ExecuTorch out-of-bounds access vulnerability

ExecuTorch integer overflow vulnerability

ExecuTorch vulnerable to Heap-based Buffer Overflow

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

XWiki Rendering is vulnerable to RCE attacks when processing nested macros

XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

Conductor vulnerable to OS command injection through unrestricted access to Java classes

XWiki allows SQL injection in query endpoint of REST API with Oracle

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Spring Security authorization bypass for method security annotations on private methods

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Apache IoTDB Vulnerable to Remote Code Execution

BRCC Incorrect Access Control vulnerability

WSO2 API Manager XML External Entity (XXE) vulnerability

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

MCMS allows arbitrary file uploads in the ueditor component

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

Apache Pinot Vulnerable to Authentication Bypass

OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request

H2O Deserialization of Untrusted Data Vulnerability

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations

Lucee RCE/XXE Vulnerability

XWiki Platform allows remote code execution as guest via SolrSearchMacros request

Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution

Apache Ignite: Possible RCE when deserializing incoming messages by the server node

GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Deep Java Library path traversal issue

Apache Ranger UI vulnerable to Server Side Request Forgery

XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing

Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

Apache MINA Deserialization RCE Vulnerability

Apache HugeGraph-Server: Fixed JWT Token (Secret)

XWiki allows remote code execution through the extension sheet

http4k has a potential XXE (XML External Entity Injection) vulnerability

XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

XWiki allows RCE from script right in configurable sections

Apache Struts file upload logic is flawed

Apache Tomcat - Authentication Bypass

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions