Browse CVEs by Ecosystem and Severity
788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-26272
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
CRITICAL
CVE-2024-45216
Improper Authentication vulnerability in Apache Solr
CRITICAL
CVE-2023-25581
pac4j-core affected by a Java deserialization vulnerability
CRITICAL
CVE-2024-21534
JSONPath Plus Remote Code Execution (RCE) Vulnerability
CRITICAL
CVE-2024-47561
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
CRITICAL
CVE-2024-46997
DataEase's H2 datasource has a remote command execution risk
HIGH
CVE-2024-7254
protobuf-java has potential Denial of Service issue
HIGH
CVE-2024-46983
SOFA Hessian Remote Command Execution (RCE) Vulnerability
HIGH
CVE-2024-45294
XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
CRITICAL
CVE-2024-45758
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
CRITICAL
CVE-2024-43202
Apache Dolphinscheduler Code Injection vulnerability
CRITICAL
CVE-2024-43400
XWiki Platform allows XSS through XClass name in string properties
CRITICAL
CVE-2024-42469
CometVisu Backend for openHAB affected by RCE through path traversal
HIGH
CVE-2024-42467
CometVisu Backend for openHAB affected by SSRF/XSS
HIGH
CVE-2024-43044
Jenkins Remoting library arbitrary file read vulnerability
CRITICAL
CVE-2023-42809
Redisson vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2024-41947
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
CRITICAL
CVE-2024-37901
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
CRITICAL
CVE-2024-37084
Remote code execution in Spring Cloud Data Flow
CRITICAL
CVE-2024-36401KEV
Remote Code Execution (RCE) vulnerability in geoserver
CRITICAL
CVE-2024-38369
XWiki programming rights may be inherited by inclusion
CRITICAL
CVE-2024-37899
XWiki Platform allows remote code execution from user account
CRITICAL
CVE-2024-37902
DeepJavaLibrary API absolute path traversal
MEDIUM
CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
CRITICAL
CVE-2024-36042
Silverpeas authentication bypass
HIGH
CVE-2024-28109
veraPDF has potential XSLT injection vulnerability when using policy files
CRITICAL
CVE-2024-32888
Amazon JDBC Driver for Redshift SQL Injection via line comment generation
MEDIUM
CVE-2024-29857
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
MEDIUM
CVE-2024-30172
Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
MEDIUM
CVE-2024-30171
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
CRITICAL
CVE-2024-4701
Genie Path Traversal vulnerability via File Uploads
CRITICAL
CVE-2024-26579
Apache Inlong Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-28253
OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
CRITICAL
CVE-2024-27348KEV
Apache HugeGraph-Server: Command execution in gremlin
CRITICAL
CVE-2024-31997
XWiki Platform remote code execution from account through UIExtension parameters
CRITICAL
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
CRITICAL
CVE-2024-31988
XWiki Platform CSRF remote code execution through the realtime HTML Converter API
CRITICAL
CVE-2024-31987
XWiki Platform remote code execution from account via custom skins support
CRITICAL
CVE-2024-31986
XWiki Platform CSRF remote code execution through scheduler job's document reference
CRITICAL
CVE-2024-31984
XWiki Platform: Remote code execution through space title and Solr space facet
CRITICAL
CVE-2024-31983
XWiki Platform: Remote code execution from edit in multilingual wikis via translations
CRITICAL
CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
CRITICAL
CVE-2024-31981
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
CRITICAL
CVE-2024-31465
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
CRITICAL
CVE-2024-31864
Apache Zeppelin remote code execution by adding malicious JDBC connection string
CRITICAL
CVE-2024-31866
Improper escaping in Apache Zeppelin
CRITICAL
CVE-2024-28125
FitNesse allows execution of arbitrary OS commands
CRITICAL
CVE-2024-28752
SSRF vulnerability using the Aegis DataBinding in Apache CXF
HIGH
CVE-2024-27894
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
CRITICAL
CVE-2024-27317
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification