Browse CVEs by Ecosystem and Severity
206 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-30220
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
HIGH
CVE-2025-27818
Apache Kafka Deserialization of Untrusted Data vulnerability
HIGH
CVE-2025-27819
Apache Kafka Deserialization of Untrusted Data vulnerability
HIGH
CVE-2025-27531
Apache InLong Deserialization of Untrusted Data Vulnerability
HIGH
CVE-2025-41235
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
HIGH
CVE-2025-48734
Apache Commons Improper Access Control vulnerability
HIGH
CVE-2025-48881
Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
HIGH
CVE-2025-27522
Apache InLong: JDBC Vulnerability during verification processing
HIGH
CVE-2025-47889
Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials
HIGH
CVE-2025-47885
Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting
HIGH
CVE-2025-46557
Any user with view access to the XWiki space can change the authenticator
HIGH
CVE-2025-29085
Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component
HIGH
CVE-2025-31129
jooby-pac4j: deserialization of untrusted data
HIGH
CVE-2025-29926
The WikiManager REST API allows any user to create wikis
HIGH
CVE-2025-26511
Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC
HIGH
CVE-2025-1247
Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance
HIGH
CVE-2025-23015
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
HIGH
CVE-2025-24814
Apache Solr vulnerable to Execution with Unnecessary Privileges
HIGH
CVE-2024-56337
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
HIGH
CVE-2024-50379
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
HIGH
CVE-2024-49203
Querydsl vulnerable to HQL injection through orderBy
HIGH
CVE-2024-51135
powertac-server XML External Entity vulnerability
HIGH
CVE-2024-52007
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
HIGH
CVE-2024-51504
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
HIGH
CVE-2024-38286
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
HIGH
CVE-2024-51132
HAPI FHIR XML External Entity (XXE) vulnerability
HIGH
CVE-2024-51127
hornetq vulnerable to file overwrite, sensitive information disclosure
HIGH
CVE-2024-23590
Apache Kylin Session Fixation vulnerability
HIGH
CVE-2024-48307
JeecgBoot SQL Injection vulnerability
HIGH
CVE-2024-26271
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
HIGH
CVE-2024-26273
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
HIGH
CVE-2024-26272
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
HIGH
CVE-2024-7254
protobuf-java has potential Denial of Service issue
HIGH
CVE-2024-46983
SOFA Hessian Remote Command Execution (RCE) Vulnerability
HIGH
CVE-2024-45294
XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
HIGH
CVE-2024-42467
CometVisu Backend for openHAB affected by SSRF/XSS
HIGH
CVE-2024-43044
Jenkins Remoting library arbitrary file read vulnerability
HIGH
CVE-2024-28109
veraPDF has potential XSLT injection vulnerability when using policy files
HIGH
CVE-2024-27894
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
HIGH
CVE-2024-27135
Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution
HIGH
CVE-2023-46226
Remote Code Execution vulnerability in Apache IoTDB via UDF
HIGH
CVE-2023-4853
Quarkus HTTP vulnerable to incorrect evaluation of permissions
HIGH
CVE-2023-36542
Apache NiFi Code Injection vulnerability
HIGH
CVE-2023-1428
gRPC Reachable Assertion issue
HIGH
CVE-2023-32731
Connection confusion in gRPC
HIGH
CVE-2023-29207
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
HIGH
CVE-2022-23496
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
HIGH
CVE-2018-1000074
RubyGems Deserialization of Untrusted Data vulnerability
HIGH
CVE-2018-1000075
RubyGems Infinite Loop vulnerability
HIGH
CVE-2018-1000073
RubyGems Link Following vulnerability