Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-29287
MCMS allows arbitrary file uploads in the ueditor component
HIGH
CVE-2025-29085
Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component
HIGH
CVE-2025-31129
jooby-pac4j: deserialization of untrusted data
CRITICAL
CVE-2025-30065
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
CRITICAL
CVE-2024-56325
Apache Pinot Vulnerable to Authentication Bypass
CRITICAL
CVE-2025-29315
OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request
CRITICAL
CVE-2024-10553
H2O Deserialization of Untrusted Data Vulnerability
HIGH
CVE-2025-29926
The WikiManager REST API allows any user to create wikis
CRITICAL
CVE-2025-24813KEV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CRITICAL
CVE-2025-27603
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations
CRITICAL
CVE-2023-38693
Lucee RCE/XXE Vulnerability
CRITICAL
CVE-2025-24893KEV
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
CRITICAL
CVE-2024-56180
Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
CRITICAL
CVE-2024-52577
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
HIGH
CVE-2025-26511
Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC
HIGH
CVE-2025-1247
Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance
CRITICAL
CVE-2024-36404
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
HIGH
CVE-2025-23015
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
CRITICAL
CVE-2025-23215
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
CRITICAL
CVE-2025-0851
Deep Java Library path traversal issue
HIGH
CVE-2025-24814
Apache Solr vulnerable to Execution with Unnecessary Privileges
CRITICAL
CVE-2024-45479
Apache Ranger UI vulnerable to Server Side Request Forgery
CRITICAL
CVE-2025-23025
XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing
CRITICAL
CVE-2024-54676
Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2024-52046
Apache MINA Deserialization RCE Vulnerability
CRITICAL
CVE-2024-43441
Apache HugeGraph-Server: Fixed JWT Token (Secret)
HIGH
CVE-2024-56337
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
HIGH
CVE-2024-50379
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
CRITICAL
CVE-2024-55662
XWiki allows remote code execution through the extension sheet
CRITICAL
CVE-2024-55875
http4k has a potential XXE (XML External Entity Injection) vulnerability
CRITICAL
CVE-2024-55877
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
CRITICAL
CVE-2024-55879
XWiki allows RCE from script right in configurable sections
CRITICAL
CVE-2024-53677
Apache Struts file upload logic is flawed
HIGH
CVE-2024-49203
Querydsl vulnerable to HQL injection through orderBy
CRITICAL
CVE-2024-52316
Apache Tomcat - Authentication Bypass
HIGH
CVE-2024-51135
powertac-server XML External Entity vulnerability
HIGH
CVE-2024-52007
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
HIGH
CVE-2024-51504
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
HIGH
CVE-2024-38286
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
HIGH
CVE-2024-51132
HAPI FHIR XML External Entity (XXE) vulnerability
HIGH
CVE-2024-51127
hornetq vulnerable to file overwrite, sensitive information disclosure
HIGH
CVE-2024-23590
Apache Kylin Session Fixation vulnerability
HIGH
CVE-2024-48307
JeecgBoot SQL Injection vulnerability
MEDIUM
CVE-2024-49771
MPXJ has a Potential Path Traversal Vulnerability
CRITICAL
CVE-2024-38821
Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications
CRITICAL
CVE-2024-47883
Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
CRITICAL
CVE-2024-38002
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
HIGH
CVE-2024-26271
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
CRITICAL
CVE-2024-8980
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
HIGH
CVE-2024-26273
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor