Browse CVEs by Ecosystem and Severity
539 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-1784
jeecg-boot vulnerable to improper authentication
CRITICAL
CVE-2023-28462
Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed
CRITICAL
CVE-2023-28326
Apache OpenMeetings missing authentication and can allow user impersonation
CRITICAL
CVE-2023-20860
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
CRITICAL
CVE-2023-27479
org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection
CRITICAL
CVE-2023-23638
Apache Dubbo vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-26477
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-26471
XWiki Platform users may execute anything with superadmin right through comments and async macro
CRITICAL
CVE-2023-26055
XWiki Platform may allow privilege escalation to programming rights via user's first name
CRITICAL
CVE-2023-26472
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
CRITICAL
CVE-2023-26474
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CRITICAL
CVE-2023-26475
xwiki-platform vulnerable to Remote Code Execution in Annotations
CRITICAL
CVE-2022-4492
Undertow client not checking server identity presented by server certificate in https connections
CRITICAL
CVE-2023-25158
GeoTools OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25157
GeoServer OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25613
Apache Kerby LdapIdentityBackend LDAP Injection vulnerability
CRITICAL
CVE-2014-125087
java-xmlbuilder vulnerable to XML External Entity Reference
CRITICAL
CVE-2023-25765
Sandbox escape in Jenkins Email Extension Plugin
CRITICAL
CVE-2022-4903
CodenameOne Pending Intent vulnerability
CRITICAL
CVE-2023-24997
Apache InLong vulnerable to Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2023-24163
Dromara hutool vulnerable to SQL Injection
CRITICAL
CVE-2023-24162
Dromara Hutool Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2022-25894
Remote Code Execution in com.bstek.uflo:uflo-core
CRITICAL
CVE-2023-24441
XML external entity vulnerability on agents in Jenkins MSTest Plugin
CRITICAL
CVE-2023-24456
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
CRITICAL
CVE-2023-24443
XML Entity Expansion in Jenkins TestComplete support Plugin
CRITICAL
CVE-2023-24430
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24429
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24427
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
CRITICAL
CVE-2023-24057
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
CRITICAL
CVE-2022-47105
Jeecg-boot is vulnerable to SQL injection
CRITICAL
CVE-2018-25068
globalpom-utils has Insecure Temporary File
CRITICAL
CVE-2016-15011
dssp vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2020-36640
bonita-connector-webservice XML External Entity vulnerability
CRITICAL
CVE-2020-36641
aXMLRPC XML External Entity vulnerability
CRITICAL
CVE-2022-45875
Apache DolphinScheduler vulnerable to Improper Input Validation
CRITICAL
CVE-2021-32824
Apache Dubbo vulnerable to remote code execution via Telnet Handler
CRITICAL
CVE-2017-20151
iText RUPS XML External Entity vulnerability
CRITICAL
CVE-2022-44621
Apache Kylin vulnerable to Command injection by Diagnosis Controller
CRITICAL
CVE-2022-4725
AWS SDK is vulnerable to server-side request forgery (SSRF)
CRITICAL
CVE-2022-36437
Hazelcast connection caching
CRITICAL
CVE-2022-45347
Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability
CRITICAL
CVE-2022-40145
Apache Karaf vulnerable to potential code injection
CRITICAL
CVE-2022-46364
Apache CXF Server-Side Request Forgery vulnerability
CRITICAL
CVE-2022-4375
Mingsoft MCMS vulnerable to SQL Injection
CRITICAL
CVE-2022-45046
camel-ldap component allows LDAP Injection when using the filter option
CRITICAL
CVE-2022-46366
Apache Tapestry allows deserialization of untrusted data
CRITICAL
CVE-2022-44262
ff4j is vulnerable to Remote Code Execution (RCE)
CRITICAL
CVE-2022-45207
Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString
CRITICAL
CVE-2022-45462
Command injection in Apache DolphinScheduler Alert Plugins