Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-8980
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
CRITICAL
CVE-2024-45216
Improper Authentication vulnerability in Apache Solr
CRITICAL
CVE-2023-25581
pac4j-core affected by a Java deserialization vulnerability
CRITICAL
CVE-2024-21534
JSONPath Plus Remote Code Execution (RCE) Vulnerability
CRITICAL
CVE-2024-47561
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
CRITICAL
CVE-2024-46997
DataEase's H2 datasource has a remote command execution risk
CRITICAL
CVE-2024-45758
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
CRITICAL
CVE-2024-43202
Apache Dolphinscheduler Code Injection vulnerability
CRITICAL
CVE-2024-43400
XWiki Platform allows XSS through XClass name in string properties
CRITICAL
CVE-2024-42469
CometVisu Backend for openHAB affected by RCE through path traversal
CRITICAL
CVE-2023-42809
Redisson vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2024-41947
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
CRITICAL
CVE-2024-37901
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
CRITICAL
CVE-2024-37084
Remote code execution in Spring Cloud Data Flow
CRITICAL
CVE-2024-36401KEV
Remote Code Execution (RCE) vulnerability in geoserver
CRITICAL
CVE-2024-38369
XWiki programming rights may be inherited by inclusion
CRITICAL
CVE-2024-37899
XWiki Platform allows remote code execution from user account
CRITICAL
CVE-2024-37902
DeepJavaLibrary API absolute path traversal
CRITICAL
CVE-2024-36042
Silverpeas authentication bypass
CRITICAL
CVE-2024-32888
Amazon JDBC Driver for Redshift SQL Injection via line comment generation
CRITICAL
CVE-2024-4701
Genie Path Traversal vulnerability via File Uploads
CRITICAL
CVE-2024-26579
Apache Inlong Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-28253
OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
CRITICAL
CVE-2024-27348KEV
Apache HugeGraph-Server: Command execution in gremlin
CRITICAL
CVE-2024-31997
XWiki Platform remote code execution from account through UIExtension parameters
CRITICAL
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
CRITICAL
CVE-2024-31988
XWiki Platform CSRF remote code execution through the realtime HTML Converter API
CRITICAL
CVE-2024-31987
XWiki Platform remote code execution from account via custom skins support
CRITICAL
CVE-2024-31986
XWiki Platform CSRF remote code execution through scheduler job's document reference
CRITICAL
CVE-2024-31984
XWiki Platform: Remote code execution through space title and Solr space facet
CRITICAL
CVE-2024-31983
XWiki Platform: Remote code execution from edit in multilingual wikis via translations
CRITICAL
CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
CRITICAL
CVE-2024-31981
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
CRITICAL
CVE-2024-31465
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
CRITICAL
CVE-2024-31864
Apache Zeppelin remote code execution by adding malicious JDBC connection string
CRITICAL
CVE-2024-31866
Improper escaping in Apache Zeppelin
CRITICAL
CVE-2024-28125
FitNesse allows execution of arbitrary OS commands
CRITICAL
CVE-2024-28752
SSRF vulnerability using the Aegis DataBinding in Apache CXF
CRITICAL
CVE-2024-27317
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
CRITICAL
CVE-2024-28213
nGrinder vulnerable to unsafe Java objects deserialization
CRITICAL
CVE-2023-51518
Apache James server: Privilege escalation via JMX pre-authentication deserialization
CRITICAL
CVE-2024-1597
org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
CRITICAL
CVE-2023-47795
Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25603
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-26269
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
CRITICAL
CVE-2024-26266
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2023-40191
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2023-42496
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2023-42498
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2024-25601
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting