Browse CVEs by Ecosystem and Severity

Apache Druid Vulnerable to Authentication Bypass

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Keycloak affected by improper invitation token validation

JinJava Bypass through ForTag leads to Arbitrary Java Execution

H2O has an External Control of File Name or Path vulnerability

Apache Continuum vulnerable to Command Injection through Installations REST API

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

XDocReport affected by an XML External Entity (XXE) vulnerability

XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

Apache Struts 2 is Missing XML Validation

XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

FASTJSON Includes Functionality from Untrusted Control Sphere

OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

Apache Kyuubi Server vulnerable to Path Traversal

Apache Log4j does not verify the TLS hostname in its Socket Appender

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Apache HugeGraph-Server: RAFT and deserialization vulnerability

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Robocode has an insecure temporary file creation vulnerability in the AutoExtract component

Robocode vulnerable to Directory Traversal in recursivelyDelete Method

Apache Tika has XXE vulnerability

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

Apache Druid’s Kerberos authenticator uses a weak fallback secret

GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Eclipse Jersey has a Race Condition

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Jenkins Azure CLI Plugin does not restrict the commands it executes

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

Apache Tomcat Vulnerable to Relative Path Traversal

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

MCMS vulnerable SQL injection via the content_title parameter

Mammoth is vulnerable to Directory Traversal

JDBC Driver for SQL Server has improper input validation issue

XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Apache Kylin Files or Directories Accessible to External Parties

Hutool allows remote code execution (RCE) via the QLExpressEngine class

H2O affected by a deserialization vulnerability

jinjava has Sandbox Bypass via JavaType-Based Deserialization

JasperReports has a Java deserialisation vulnerability

Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

Apache DolphinScheduler vulnerable to Alert Script Attack

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

XWiki configuration files can be accessed through jsx and sx endpoints

XWiki configuration files can be accessed through the webjars API

Valtimo scripting engine can be used to gain access to sensitive data or resources

Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)

hippo4j Includes Hard Coded Secret Key in JWT Creation