Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2021-31635
jFinal Server-Side Template Injection vulnerability
CRITICAL
CVE-2023-35161
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
CRITICAL
CVE-2023-35160
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
CRITICAL
CVE-2023-35159
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
CRITICAL
CVE-2023-35158
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
CRITICAL
CVE-2023-35156
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
CRITICAL
CVE-2023-34340
Apache Accumulo Improper Authentication vulnerability
CRITICAL
CVE-2023-35162
XWiki Platform vulnerable to cross-site scripting via xcontinue parameter in previewactions template
CRITICAL
CVE-2023-35152
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
CRITICAL
CVE-2023-35150
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
CRITICAL
CVE-2023-34465
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
CRITICAL
CVE-2023-34464
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
CRITICAL
CVE-2023-35839
Solon vulnerable to deserialization of untrusted data
CRITICAL
CVE-2023-34659
jeecg-boot SQL injection vulnerability
CRITICAL
CVE-2023-35042
GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
CRITICAL
CVE-2023-33496
xxl-rpc deserialization vulnerability
CRITICAL
CVE-2023-31890
glazedlists XML Deserialization vulnerability
CRITICAL
CVE-2022-47937
Apache Sling Commons JSON bundle vulnerable to Improper Input Validation
CRITICAL
CVE-2023-32070
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
CRITICAL
CVE-2023-32069
Privilege escalation (PR)/RCE from account through class sheet
CRITICAL
CVE-2023-30331
Server-side template injection in beetl
CRITICAL
CVE-2023-25826
Command injection in OpenTSDB
CRITICAL
CVE-2023-30349
Remote code execution in JFinal CMS
CRITICAL
CVE-2023-29924
PowerJob vulnerable to incorrect access control
CRITICAL
CVE-2023-29525
XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration
CRITICAL
CVE-2023-29527
XWiki Platform vulnerable to code injection from account through AWM view sheet
CRITICAL
CVE-2023-29526
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
CRITICAL
CVE-2023-29524
XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet
CRITICAL
CVE-2023-29523
XWiki Platform vulnerable to code injection in display method used in user profiles
CRITICAL
CVE-2023-29516
XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector
CRITICAL
CVE-2023-29514
XWiki vulnerable to Code Injection in template provider administration
CRITICAL
CVE-2023-29512
xwiki-platform-web-templates vulnerable to Eval Injection
CRITICAL
CVE-2023-20873
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
CRITICAL
CVE-2023-29926
PowerJob vulnerable to remote code execution
CRITICAL
CVE-2023-29510
Code injection via unescaped translations in xwiki-platform
CRITICAL
CVE-2023-24831
Apache IoTDB Grafana Connector vulnerable to Improper Authentication
CRITICAL
CVE-2023-22946
Apache Spark vulnerable to Improper Privilege Management
CRITICAL
CVE-2023-29205
org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
CRITICAL
CVE-2023-29511
xwiki-platform-administration-ui vulnerable to privilege escalation
CRITICAL
CVE-2023-30537
org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation
CRITICAL
CVE-2023-29509
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29214
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29212
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29211
org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
CRITICAL
CVE-2023-29210
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29209
org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
CRITICAL
CVE-2023-29215
Apache Linkis JDBC EngineConn has deserialization vulnerability
CRITICAL
CVE-2023-29216
Apache Linkis DatasourceManager module has deserialization vulnerability
CRITICAL
CVE-2023-25330
MyBatis-Plus vulnerable to SQL injection via TenantPlugin
CRITICAL
CVE-2020-20913
Ming-Soft MCMS vulnerable to SQL injection