Critical Maven package vulnerabilities

CVE-2026-107282 · Maven

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

CVE-2026-107726 · Maven

Hazelcast allows arbitrary member memory access by low-privileged client

CVE-2026-103922 · npm

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

CVE-2026-61741 · Maven

http4s-scala-xml has an XML External Entity (XXE) processing issue

CVE-2026-85724 · Maven

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

CVE-2025-53837 · Maven

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

CVE-2026-69204 · Maven

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

CVE-2026-11746 · Maven

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

CVE-2026-84939 · Maven

Apache FreeMarker template loading mechanism vulnerable to path traversal

CVE-2026-75595 · Maven

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

CVE-2026-55511 · Maven

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

CVE-2026-55559 · Maven

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

CVE-2026-55565 · Maven

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

CVE-2026-47884 · Maven

Spring Framework Improper Path Limitation in XsltView

CVE-2026-47890 · Maven

Spring Framework Server Sent Event stream corruption while rendering fragments

CVE-2026-47892 · Maven

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

CVE-2026-65182 · Maven

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

CVE-2026-65905 · Maven

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

CVE-2026-68525 · Maven

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

CVE-2026-66906 · Maven

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

CVE-2026-71300 · Maven

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

CVE-2026-78329 · Maven

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

CVE-2026-76904 · Maven

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

CVE-2026-18963 · Maven

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

CVE-2026-28672 · Maven

Apache Ranger has a Command Injection vulnerability

CVE-2026-8763 · Maven

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

CVE-2026-62263 · Maven

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

CVE-2026-62379 · Maven

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

CVE-2026-73644 · Maven

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

GHSA-68r5-9hpg-7qw9 · Maven

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

CVE-2026-16723 · Maven

fastjson has a remote code execution (RCE) vulnerability

CVE-2026-40047 · Maven

Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

CVE-2026-43867 · Maven

Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

CVE-2026-46454 · Maven

Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

CVE-2026-46455 · Maven

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

CVE-2026-46456 · Maven

Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

CVE-2026-48203 · Maven

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document f

CVE-2026-48204 · Maven

Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers

CVE-2026-48205 · Maven

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

CVE-2026-53913 · Maven

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

CVE-2026-56140 · Maven

Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

CVE-2026-54617 · Maven

LaunchServer FileServerHandler has an unauthenticated path traversal issue

CVE-2026-53434 · Maven

Apache Tomcat util accepted misconfigured CRLs

CVE-2026-45051 · Maven

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

CVE-2026-45052 · Maven

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

CVE-2026-12866 · npm

expr-eval vulnerable to Code Execution

CVE-2026-44179 · Maven

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

CVE-2026-44203 · Maven

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

CVE-2026-46495 · Maven

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

CVE-2026-56120 · Maven

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

CVE-2026-32966 · Maven

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

CVE-2026-32967 · Maven

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

CVE-2026-55471 · Maven

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

CVE-2026-39006 · Maven

SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

CVE-2026-49875 · Maven

Apache CXF has Improper Restriction of XML External Entity Reference

CVE-2026-50627 · Maven

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

CVE-2026-50628 · Maven

Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

CVE-2026-50632 · Maven

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

CVE-2026-50633 · Maven

Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

CVE-2026-50076 · Maven

Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

CVE-2026-47065 · Maven

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

CVE-2026-44632 · Maven

Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

CVE-2026-46562 · Maven

Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override

CVE-2026-46621 · Maven

Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

CVE-2026-23734 · Maven

XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

CVE-2026-33137 · Maven

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

CVE-2026-44930 · Maven

Apache CXF has an LDAP injection vulnerability

CVE-2026-2586 · Maven

GlassFish's Administration Console is Vulnerable to RCE

CVE-2026-2587 · Maven

GlassFish's gadget handler is vulnerable to RCE

CVE-2026-47323 · Maven

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

CVE-2026-8178 · Maven

Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading

CVE-2026-44672 · Maven

Mapfish Print: Remote Code Injection (RCE) in Dynamic table

CVE-2026-45083 · Maven

Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy

CVE-2026-33117 · Maven

Security feature bypass vulnerability in Azure Key Vault Keys library for Java

CVE-2026-41293 · Maven

Apache Tomcat - HTTP/2 request headers not validated

CVE-2026-43512 · Maven

Apache Tomcat - Digest authenticator will authenticate any unknown user

CVE-2026-43515 · Maven

Apache Tomcat - Security constraints not correctly applied

CVE-2026-45091 · npm

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

CVE-2026-27478 · Maven

Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

CVE-2026-40982 · Maven

Spring Cloud Config vulnerable to Path Traversal

CVE-2026-40010 · Maven

Apache Wicket has a Session Fixation issue

CVE-2026-42555 · Maven

Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

CVE-2026-44221 · Maven

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

CVE-2026-7411 · Maven

Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

CVE-2026-40076 · Maven

OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)

CVE-2026-40682 · Maven

Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing

CVE-2026-41258 · Maven

OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange

CVE-2026-41901 · Maven

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

CVE-2026-42027 · Maven

Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest

CVE-2026-42809 · Maven

Apache Polaris has an Improper Input Validation Issue

CVE-2026-42810 · Maven

Apache Polaris has an Improper Input Validation Issue

CVE-2026-42811 · Maven

Apache Polaris has an Improper Input Validation issue

CVE-2026-42812 · Maven

Apache Polaris has an Improper Input Validation issue

CVE-2026-42778 · Maven

Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)

CVE-2026-42779 · Maven

Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

CVE-2026-36767 · Maven

Shopizer has a path traversal issue

CVE-2026-41586 · Maven

fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE

CVE-2026-42523 · Maven

Jenkins GitHub Plugin has an XSS vulnerability

CVE-2026-40976 · Maven

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

CVE-2026-33453 · Maven

Apache camel-coap allows header injection that can lead to remote code execution

CVE-2026-33454 · Maven

Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

CVE-2026-40453 · Maven

Apache Camel has an incomplete fix for CVE-2025-27636

CVE-2026-40860 · Maven

Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

CVE-2026-41409 · Maven

Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)

CVE-2026-41635 · Maven

Apache MINA vulnerable to Deserialization of Untrusted Data

CVE-2026-32604 · Maven

Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

CVE-2026-32613 · Maven

Spinnaker: RCE via expression parsing due to unrestricted context handling

CVE-2026-33557 · Maven

Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation

CVE-2025-14813 · Maven

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

CVE-2026-40477 · Maven

Improper restriction of the scope of accessible objects in Thymeleaf expressions

CVE-2026-40478 · Maven

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

CVE-2026-39842 · Maven

Expression Injection in OpenRemote

CVE-2026-29145 · Maven

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

CVE-2026-35580 · Maven

Emissary has GitHub Actions Shell Injection via Workflow Inputs

CVE-2026-33439 · Maven

OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

CVE-2026-34361 · Maven

FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

CVE-2026-22738 · Maven

Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

CVE-2026-33728 · Maven

dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

GHSA-h8w2-rv57-vc6f · Maven

splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

CVE-2026-33701 · Maven

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

CVE-2026-22732 · Maven

Spring Security HTTP Headers Are not Written Under Some Conditions

CVE-2026-33180 · Maven

HAPI FHIR HTTP authentication leak in redirects

CVE-2026-25534 · Maven

Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames

CVE-2026-24015 · Maven

Apache IoTDB has an Insecure Default Configuration Vulnerability

CVE-2026-24713 · Maven

Apache IoTDB has an Improper Input Validation vulnerability

CVE-2026-29000 · Maven

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

CVE-2026-27446 · Maven

Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

CVE-2025-59059 · Maven

Apache Ranger has a Code Injection vulnerability

CVE-2026-23552 · Maven

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

CVE-2025-13590 · Maven

carbon-apimgt does not properly restrict uploaded files

CVE-2026-23906 · Maven

Apache Druid Vulnerable to Authentication Bypass

CVE-2026-25526 · Maven

JinJava Bypass through ForTag leads to Arbitrary Java Execution

CVE-2024-5986 · Maven

H2O has an External Control of File Name or Path vulnerability

CVE-2016-15057 · Maven

Apache Continuum vulnerable to Command Injection through Installations REST API

CVE-2025-64087 · Maven

XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

CVE-2025-65482 · Maven

XDocReport affected by an XML External Entity (XXE) vulnerability

CVE-2025-65091 · Maven

XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

CVE-2025-70974 · Maven

FASTJSON Includes Functionality from Untrusted Control Sphere

CVE-2025-12543 · Maven

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

CVE-2025-14306 · Maven

Robocode vulnerable to Directory Traversal in recursivelyDelete Method

CVE-2025-14307 · Maven

Robocode has an insecure temporary file creation vulnerability in the AutoExtract component

CVE-2025-66516 · Maven

Apache Tika has XXE vulnerability

CVE-2025-59390 · Maven

Apache Druid’s Kerberos authenticator uses a weak fallback secret

CVE-2025-64408 · Maven

Apache Causeway vulnerable to deserialization in Java

CVE-2025-12383 · Maven

Eclipse Jersey has a Race Condition

CVE-2025-56316 · Maven

MCMS vulnerable SQL injection via the content_title parameter

CVE-2025-49594 · Maven

XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

CVE-2025-52472 · Maven

XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

CVE-2025-48459 · Maven

Apache IoTDB: Deserialization of untrusted Data

CVE-2025-6544 · Maven

H2O affected by a deserialization vulnerability

CVE-2025-59340 · Maven

jinjava has Sandbox Bypass via JavaType-Based Deserialization

CVE-2025-41243 · Maven

Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

CVE-2025-55747 · Maven

XWiki configuration files can be accessed through the webjars API

CVE-2025-55748 · Maven

XWiki configuration files can be accessed through jsx and sx endpoints

CVE-2025-58059 · Maven

Valtimo scripting engine can be used to gain access to sensitive data or resources

CVE-2025-54988 · Maven

Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

CVE-2025-30404 · PyPI

ExecuTorch integer overflow vulnerability

CVE-2025-30405 · PyPI

ExecuTorch integer overflow vulnerability

CVE-2025-54949 · PyPI

ExecuTorch heap buffer overflow vulnerability

CVE-2025-54950 · PyPI

ExecuTorch out-of-bounds access vulnerability

CVE-2025-54951 · PyPI

ExecuTorch vulnerable to Heap-based Buffer Overflow

CVE-2025-32429 · Maven

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

CVE-2025-53835 · Maven

XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

CVE-2025-53836 · Maven

XWiki Rendering is vulnerable to RCE attacks when processing nested macros

CVE-2025-26074 · Maven

Conductor vulnerable to OS command injection through unrestricted access to Java classes

CVE-2024-56158 · Maven

XWiki allows SQL injection in query endpoint of REST API with Oracle

CVE-2024-34711 · Maven

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

GHSA-826p-4gcg-35vw · Maven

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

CVE-2025-41232 · Maven

Spring Security authorization bypass for method security annotations on private methods

CVE-2024-24780 · Maven

Apache IoTDB Vulnerable to Remote Code Execution

CVE-2025-4641 · Maven

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

CVE-2025-47884 · Maven

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

CVE-2025-2905 · Maven

WSO2 API Manager XML External Entity (XXE) vulnerability

CVE-2025-45616 · Maven

BRCC Incorrect Access Control vulnerability

CVE-2025-46558 · Maven

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

CVE-2025-32973 · Maven

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

CVE-2025-32974 · Maven

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

CVE-2025-32969 · Maven

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

CVE-2025-29287 · Maven

MCMS allows arbitrary file uploads in the ueditor component

CVE-2024-56325 · Maven

Apache Pinot Vulnerable to Authentication Bypass

CVE-2025-30065 · Maven

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

CVE-2025-29315 · Maven

OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request

CVE-2024-10553 · PyPI

H2O Deserialization of Untrusted Data Vulnerability

CVE-2025-24813 · Maven

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

CVE-2025-27603 · Maven

com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations

CVE-2023-38693 · Maven

Lucee RCE/XXE Vulnerability

CVE-2025-24893 · Maven

XWiki Platform allows remote code execution as guest via SolrSearchMacros request

CVE-2024-52577 · Maven

Apache Ignite: Possible RCE when deserializing incoming messages by the server node

CVE-2024-56180 · Maven

Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution

CVE-2024-36404 · Maven

GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

CVE-2025-23215 · Maven

PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

GHSA-vpxm-cr3r-pjp9 · Maven

General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches

CVE-2025-0851 · Maven

Deep Java Library path traversal issue

CVE-2024-45479 · Maven

Apache Ranger UI vulnerable to Server Side Request Forgery

CVE-2025-23025 · Maven

XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing

CVE-2024-54676 · Maven

Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

CVE-2024-52046 · Maven

Apache MINA Deserialization RCE Vulnerability

CVE-2024-43441 · Maven

Apache HugeGraph-Server: Fixed JWT Token (Secret)

CVE-2024-55662 · Maven

XWiki allows remote code execution through the extension sheet

CVE-2024-55875 · Maven

http4k has a potential XXE (XML External Entity Injection) vulnerability

CVE-2024-55877 · Maven

XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

CVE-2024-55879 · Maven

XWiki allows RCE from script right in configurable sections

CVE-2024-53677 · Maven

Apache Struts file upload logic is flawed

CVE-2024-53990 · Maven

AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

CVE-2024-52316 · Maven

Apache Tomcat - Authentication Bypass

CVE-2024-38821 · Maven

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

CVE-2024-47883 · Maven

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

CVE-2024-38002 · Maven

Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

CVE-2024-8980 · Maven

Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

CVE-2024-45216 · Maven

Improper Authentication vulnerability in Apache Solr

CVE-2023-25581 · Maven

pac4j-core affected by a Java deserialization vulnerability

CVE-2024-21534 · Maven

JSONPath Plus Remote Code Execution (RCE) Vulnerability

CVE-2024-47561 · Maven

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

CVE-2024-47806 · Maven

Jenkins OpenId Connect Authentication Plugin lacks audience claim validation

CVE-2024-47807 · Maven

Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation

CVE-2024-46997 · Maven

DataEase's H2 datasource has a remote command execution risk

GHSA-2gh6-wc3m-g37f · Maven

hermes-management is vulnerable to RCE due to Apache commons-jxpath

CVE-2024-22399 · Maven

Apache Seata Deserialization of Untrusted Data vulnerability

CVE-2024-45758 · Maven

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

CVE-2024-43202 · Maven

Apache Dolphinscheduler Code Injection vulnerability

CVE-2024-43400 · Maven

XWiki Platform allows XSS through XClass name in string properties

CVE-2024-43401 · Maven

In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

CVE-2024-42469 · Maven

CometVisu Backend for openHAB affected by RCE through path traversal

CVE-2023-42809 · Maven

Redisson vulnerable to Deserialization of Untrusted Data

CVE-2023-45146 · Maven

XXL-RPC Deserialization of Untrusted Data vulnerability

CVE-2024-37901 · Maven

XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

CVE-2024-41947 · Maven

XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution

CVE-2024-37084 · Maven

Remote code execution in Spring Cloud Data Flow

CVE-2023-7272 · Maven

Eclipse Parsson stack overflow when parsing deeply nested input

CVE-2024-36401 · Maven

Remote Code Execution (RCE) vulnerability in geoserver

CVE-2024-29868 · Maven

Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

CVE-2024-38369 · Maven

XWiki programming rights may be inherited by inclusion

CVE-2024-37899 · Maven

XWiki Platform allows remote code execution from user account

CVE-2024-37902 · Maven

DeepJavaLibrary API absolute path traversal

CVE-2024-36265 · Maven

Apache Submarine Server Core Incorrect Authorization vulnerability

CVE-2024-36042 · Maven

Silverpeas authentication bypass

CVE-2024-32888 · Maven

Amazon JDBC Driver for Redshift SQL Injection via line comment generation

CVE-2024-34365 · Maven

Apache Karaf Cave: Cave SSRF and arbitrary file access

CVE-2024-4701 · Maven

Genie Path Traversal vulnerability via File Uploads

CVE-2024-26579 · Maven

Apache Inlong Deserialization of Untrusted Data vulnerability

CVE-2024-28253 · Maven

OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)

CVE-2024-27348 · Maven

Apache HugeGraph-Server: Command execution in gremlin

CVE-2024-31465 · Maven

XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

CVE-2024-31981 · Maven

XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

CVE-2024-31982 · Maven

XWiki Platform: Remote code execution as guest via DatabaseSearch

CVE-2024-31983 · Maven

XWiki Platform: Remote code execution from edit in multilingual wikis via translations

CVE-2024-31984 · Maven

XWiki Platform: Remote code execution through space title and Solr space facet

CVE-2024-31986 · Maven

XWiki Platform CSRF remote code execution through scheduler job's document reference

CVE-2024-31987 · Maven

XWiki Platform remote code execution from account via custom skins support

CVE-2024-31988 · Maven

XWiki Platform CSRF remote code execution through the realtime HTML Converter API

CVE-2024-31996 · Maven

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

CVE-2024-31997 · Maven

XWiki Platform remote code execution from account through UIExtension parameters

CVE-2024-31864 · Maven

Apache Zeppelin remote code execution by adding malicious JDBC connection string

CVE-2024-31866 · Maven

Improper escaping in Apache Zeppelin

CVE-2024-28125 · Maven

FitNesse allows execution of arbitrary OS commands

CVE-2024-28752 · Maven

SSRF vulnerability using the Aegis DataBinding in Apache CXF

CVE-2024-27317 · Maven

Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

CVE-2024-28213 · Maven

nGrinder vulnerable to unsafe Java objects deserialization

CVE-2024-26580 · Maven

Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

CVE-2023-51518 · Maven

Apache James server: Privilege escalation via JMX pre-authentication deserialization

CVE-2024-1735 · Maven

Armeria SAML authentication bypass due to missing validation on unsigned SAML messages

GHSA-hx5q-v6pj-533r · Maven

SAML authentication bypass due to missing validation on unsigned SAML messages

CVE-2023-40191 · Maven

Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting

CVE-2023-42496 · Maven

Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting

CVE-2023-42498 · Maven

Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting

CVE-2023-47795 · Maven

Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting

CVE-2024-1597 · Maven

org.postgresql:postgresql vulnerable to SQL Injection via line comment generation

CVE-2024-25147 · Maven

Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

CVE-2024-25152 · Maven

Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting

CVE-2024-25601 · Maven

Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting

CVE-2024-25602 · Maven

Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting

CVE-2024-25603 · Maven

Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting

CVE-2024-26266 · Maven

Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting

CVE-2024-26269 · Maven

Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting

CVE-2023-49109 · Maven

Remote Code Execution in Apache Dolphinscheduler

CVE-2024-25610 · Maven

Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)

CVE-2024-25145 · Maven

Liferay Portal stored cross-site scripting (XSS) vulnerability

CVE-2024-1143 · Maven

Central Dogma Authentication Bypass Vulnerability via Session Leakage

CVE-2024-22533 · Maven

Beetl Server-Side Template Injection vulnerability

CVE-2024-23897 · Maven

Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

CVE-2024-23636 · Maven

Remote Command Execution in SOFARPC

CVE-2017-20189 · Maven

Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

CVE-2024-21650 · Maven

XWiki Remote Code Execution Vulnerability via User Registration

CVE-2023-51784 · Maven

Apache InLong Manager Remote Code Execution vulnerability