Browse CVEs by Ecosystem and Severity

Hazelcast allows arbitrary member memory access by low-privileged client

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

http4s-scala-xml has an XML External Entity (XXE) processing issue

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Apache FreeMarker template loading mechanism vulnerable to path traversal

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring Framework Improper Path Limitation in XsltView

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

Apache Ranger has a Command Injection vulnerability

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

fastjson has a remote code execution (RCE) vulnerability

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers

Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

LaunchServer FileServerHandler has an unauthenticated path traversal issue

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

expr-eval vulnerable to Code Execution

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks