Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-44311
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
CRITICAL
CVE-2023-42628
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
CRITICAL
CVE-2023-42497
Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
CRITICAL
CVE-2023-45138
XWiki Change Request Application UI XSS and remote code execution through change request title
CRITICAL
CVE-2023-43668
Authorization Bypass in Apache InLong
CRITICAL
CVE-2023-44981
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
CRITICAL
CVE-2023-40989
SQL injection in jeecgboot
CRITICAL
CVE-2022-24816KEV
Improper Control of Generation of Code ('Code Injection') in jai-ext
CRITICAL
CVE-2023-41887
OpenRefine Remote Code execution in project import with mysql jdbc url attack
CRITICAL
CVE-2023-42277
hutool Buffer Overflow vulnerability
CRITICAL
CVE-2023-42276
hutool Buffer Overflow vulnerability
CRITICAL
CVE-2023-42268
Jeecg boot SQL Injection vulnerability
CRITICAL
CVE-2023-40743
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
CRITICAL
CVE-2023-40177
XWiki Platform privilege escalation (PR) from account through AWM content fields
CRITICAL
CVE-2023-37914
XWiki Platform privilege escalation (PR)/RCE from account through Invitation subject/message
CRITICAL
CVE-2023-38889
Alluxio vulnerable to arbitrary code execution
CRITICAL
CVE-2023-36480
Aerospike Java Client vulnerable to unsafe deserialization of server responses
CRITICAL
CVE-2023-37754
Code injection in PowerJob
CRITICAL
CVE-2023-39020
Code injection in stanford-parser
CRITICAL
CVE-2023-39022
Code injection in oscore
CRITICAL
CVE-2023-39010
Code injection in BoofCV
CRITICAL
CVE-2023-39021
Code injection in wix-embedded-mysql
CRITICAL
CVE-2023-39015
Code injection in webmagic-core
CRITICAL
CVE-2023-39013
Code injection in Duke
CRITICAL
CVE-2023-38992
SQL injection in jeecg-boot
CRITICAL
CVE-2023-38647
Deserialization vulnerability in Helix workflow and REST
CRITICAL
CVE-2023-37895
Remote code execution in Apache Jackrabbit
CRITICAL
CVE-2024-23687
Hard-coded System User Credentials in Folio Data Export Spring module
CRITICAL
CVE-2023-35088
SQL injection in audit endpoint
CRITICAL
CVE-2023-34478
Path Traversal in Apache Shiro
CRITICAL
CVE-2023-34034
Access Control Bypass in Spring Security
CRITICAL
CVE-2023-26512
rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message
CRITICAL
CVE-2023-37462
org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability
CRITICAL
CVE-2023-30429
Apache Pulsar Incorrect Authorization vulnerability
CRITICAL
CVE-2023-37582
RocketMQ NameServer component Code Injection vulnerability
CRITICAL
CVE-2023-37277
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
CRITICAL
CVE-2023-33246KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
CRITICAL
CVE-2023-31065
Apache InLong Insufficient Session Expiration vulnerability
CRITICAL
CVE-2023-31062
Apache InLong Improper Privilege Management vulnerability
CRITICAL
CVE-2023-31098
Apache InLong has Weak Password Requirements in Apache InLong
CRITICAL
CVE-2022-45802
Apache StreamPark Path Traversal vulnerability
CRITICAL
CVE-2023-26119
HtmlUnit Code Injection vulnerability
CRITICAL
CVE-2023-27603
Apache Linkis Zip Slip issue
CRITICAL
CVE-2023-27602
Apache Linkis Unrestricted File Upload vulnerability
CRITICAL
CVE-2022-24697
Apache Kylin vulnerable to remote code execution
CRITICAL
CVE-2023-36812
Remote Code Execution for 2.4.1 and earlier
CRITICAL
CVE-2023-36468
Upgrading doesn't prevent exploiting vulnerable XWiki documents
CRITICAL
CVE-2023-36469
XWiki Platform vulnerable to Code injection through NotificationRSSService
CRITICAL
CVE-2023-36470
XWiki Platform vulnerable to Code Injection in icon themes
CRITICAL
CVE-2022-4361
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC