Browse CVEs by Ecosystem and Severity

Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Apache Seata: Deserialization of untrusted Data in Apache Seata Server

Apache CXF: Untrusted JMS configuration can lead to RCE

ExecuTorch integer overflow vulnerability

ExecuTorch heap buffer overflow vulnerability

ExecuTorch out-of-bounds access vulnerability

ExecuTorch integer overflow vulnerability

ExecuTorch vulnerable to Heap-based Buffer Overflow

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

XWiki Rendering is vulnerable to RCE attacks when processing nested macros

XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build

Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

Conductor vulnerable to OS command injection through unrestricted access to Java classes

PowSyBl Core allows deserialization of untrusted SparseMatrix data

Apache Tomcat installer for Windows has an untrusted search path vulnerability

Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler

XWiki does not require right warnings for XClass definitions

XWiki allows remote code execution through preview of XClass changes in AWM editor

XWiki does not require right warnings for notification displayer objects

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

XWiki's required right warnings for macros are incomplete

XWiki allows SQL injection in query endpoint of REST API with Oracle

[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

Apache Kafka Deserialization of Untrusted Data vulnerability

Apache Kafka Deserialization of Untrusted Data vulnerability

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Apache InLong Deserialization of Untrusted Data Vulnerability

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Apache Commons Improper Access Control vulnerability

Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Apache InLong: JDBC Vulnerability during verification processing

Spring Security authorization bypass for method security annotations on private methods

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Apache IoTDB Vulnerable to Remote Code Execution

JRuby-OpenSSL has hostname verification disabled by default

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

BRCC Incorrect Access Control vulnerability

WSO2 API Manager XML External Entity (XXE) vulnerability

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

Any user with view access to the XWiki space can change the authenticator

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

Apache Tomcat Denial of Service via invalid HTTP priority header

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API