Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-25152
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25602
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25147
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
CRITICAL
CVE-2024-25610
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
CRITICAL
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
CRITICAL
CVE-2024-25145
Liferay Portal stored cross-site scripting (XSS) vulnerability
CRITICAL
CVE-2024-1143
Central Dogma Authentication Bypass Vulnerability via Session Leakage
CRITICAL
CVE-2024-22533
Beetl Server-Side Template Injection vulnerability
CRITICAL
CVE-2024-23897KEV
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CRITICAL
CVE-2024-23636
Remote Command Execution in SOFARPC
CRITICAL
CVE-2017-20189
Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization
CRITICAL
CVE-2024-21650
XWiki Remote Code Execution Vulnerability via User Registration
CRITICAL
CVE-2023-51784
Apache InLong Manager Remote Code Execution vulnerability
CRITICAL
CVE-2023-41542
Jeecg Boot SQL injection vulnerability
CRITICAL
CVE-2023-41543
Jeecg Boot SQL Injection
CRITICAL
CVE-2023-51084
hyavijava stack overflow vulnerability
CRITICAL
CVE-2023-51656
Apache IoTDB: Unsafe deserialize map in Sync Tool
CRITICAL
CVE-2023-50723
Remote code execution/programming rights with configuration section from any user account
CRITICAL
CVE-2023-50722
XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
CRITICAL
CVE-2023-50721
Remote code execution from account through SearchAdmin
CRITICAL
CVE-2023-29234
Bypass serialize checks in Apache Dubbo
CRITICAL
CVE-2023-46279
Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
CRITICAL
CVE-2023-50422
Improper JWT Signature Validation in SAP Security Services Library
CRITICAL
CVE-2023-50164
Apache Struts vulnerable to path traversal
CRITICAL
CVE-2023-49093
HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
CRITICAL
CVE-2023-48910
Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
CRITICAL
CVE-2023-48967
Solon is vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-48887
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
CRITICAL
CVE-2023-49371
RuoYi vulnerable to SQL injection vulnerability
CRITICAL
CVE-2023-49733
Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability
CRITICAL
CVE-2022-45135
Apache Cocoon SQL Injection vulnerability
CRITICAL
CVE-2023-48292
Run Shell Command allows Cross-Site Request Forgery
CRITICAL
CVE-2023-48240
Cookies are sent to external images in rendered diff (and server side request forgery)
CRITICAL
CVE-2022-46337
Apache Derby: LDAP injection vulnerability in authenticator
CRITICAL
CVE-2023-47797
Liferay Portal XSS with `p_l_back_url_title` on edit content page
CRITICAL
CVE-2023-46732
XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu
CRITICAL
CVE-2023-46731
XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest
CRITICAL
CVE-2023-46242
XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
CRITICAL
CVE-2023-46502
OpenCRX allows a remote attacker to execute arbitrary code via a crafted request
CRITICAL
CVE-2023-46604KEV
Apache ActiveMQ is vulnerable to Remote Code Execution
CRITICAL
CVE-2023-45137
XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
CRITICAL
CVE-2023-45136
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
CRITICAL
CVE-2023-45135
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
CRITICAL
CVE-2023-45134
XWiki Platform XSS vulnerability from account in the create page form via template provider
CRITICAL
CVE-2023-37913
org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
CRITICAL
CVE-2023-37908
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
CRITICAL
CVE-2023-44794
SaToken privilege escalation vulnerability
CRITICAL
CVE-2023-31581
Sureness uses hardcoded key
CRITICAL
CVE-2023-42627
Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module
CRITICAL
CVE-2023-45144
XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter