Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unavailability
CRITICAL
CVE-2026-39842
Expression Injection in OpenRemote
HIGH
CVE-2026-5795
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
HIGH
CVE-2026-35582
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
HIGH
CVE-2026-35337
Apache Storm: Deserialization of Untrusted Data vulnerability
HIGH
CVE-2026-39304
Apache ActiveMQ: Denial of Service via Out of Memory vulnerability
HIGH
CVE-2026-34486KEV
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
HIGH
CVE-2026-34483
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
HIGH
CVE-2026-34487
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
HIGH
CVE-2026-24880
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
HIGH
CVE-2026-29129
Apache Tomcat: Configured cipher preference order not preserved
CRITICAL
CVE-2026-29145
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
HIGH
CVE-2026-29146
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
CRITICAL
CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
HIGH
CVE-2026-27314
Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator
CRITICAL
CVE-2026-33439
OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
HIGH
CVE-2026-35554
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
HIGH
CVE-2026-34197KEV
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
CRITICAL
CVE-2026-34361
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
HIGH
CVE-2026-28367
Undertow is Vulnerable to HTTP Request/Response Smuggling
HIGH
CVE-2026-28368
Undertow is Vulnerable to HTTP Request/Response Smuggling
HIGH
CVE-2026-28369
Undertow is Vulnerable to HTTP Request/Response Smuggling
HIGH
CVE-2026-22742
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
CRITICAL
CVE-2026-22738
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
CRITICAL
CVE-2026-33728
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
CRITICAL
CVE-2026-33701
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
HIGH
CVE-2026-22739
Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
HIGH
CVE-2026-22731
Spring Boot has an Authentication Bypass under Actuator Health groups paths
CRITICAL
CVE-2026-22732
Spring Security HTTP Headers Are not Written Under Some Conditions
HIGH
CVE-2026-22733
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
CRITICAL
CVE-2026-33180
HAPI FHIR HTTP authentication leak in redirects
HIGH
CVE-2026-33166
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
HIGH
CVE-2026-33001
Jenkins has a link following vulnerability allows arbitrary file creation
HIGH
CVE-2026-22730
SQL Injection in Spring AI MariaDBFilterExpressionConverter
HIGH
CVE-2026-22729
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
HIGH
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerability
CRITICAL
CVE-2026-25534
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
CRITICAL
CVE-2026-24713
Apache IoTDB has an Improper Input Validation vulnerability
CRITICAL
CVE-2026-24015
Apache IoTDB has an Insecure Default Configuration Vulnerability
HIGH
CVE-2026-3047
Keycloak SAML Broken has Authentication Bypass by Primary Weakness
CRITICAL
CVE-2026-29000
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
HIGH
CVE-2025-66024
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
CRITICAL
CVE-2026-27446
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
CRITICAL
CVE-2025-59059
Apache Ranger has a Code Injection vulnerability
HIGH
CVE-2026-27830
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
HIGH
CVE-2026-27727
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
CRITICAL
CVE-2026-23552
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
CRITICAL
CVE-2025-13590
carbon-apimgt does not properly restrict uploaded files
MEDIUM
CVE-2025-66614
Apache Tomcat - Client certificate verification bypass
HIGH
CVE-2026-24734
Apache Tomcat has an Improper Input Validation vulnerability