Browse CVEs by Ecosystem and Severity

Hazelcast has an authorization bypass in IMap Predicates API

MPXJ: XXE Vulnerability in MerlinReader

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

MapFish Print has XXE that allows reading arbitrary files of certain types

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Sakai Conversations has a Stored XSS Issue

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

http4k: `DigestAuthProvider.verify` did not bind to request URI

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

Apache Camel JMS deserialization filter bypass

Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

OpenAM has Unsafe Java Deserialization via SNS

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

Apache NiFi: Missing authorization when replacing Process Groups with restricted components

CedarJava has policy injection vulnerability

CedarJava has type confusion vulnerability

LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

Spring for GraphQL: Cross-Site WebSocket Hijacking

Spring for GraphQL: Unsafe Deserialization

Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation