Priority CRITICAL 94KEV
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.99968 · Published 2017-10-03 · Partial fix · 9.0.1, 8.5.23 +2 CWE-434
Priority CRITICAL 88KEV
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
CVSS 3.1MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.84887 · Published 2020-04-29 · Partial fix · 3.5.0, 4.4.0 CWE-79
Priority HIGH 81
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI).
CVSS 3.0HIGH 8.6· Network · No auth · No interaction · EPSS 0.71184 · Published 2019-04-23 · No fix listed
Priority HIGH 79
XStream is software for serializing Java objects to XML and back again.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.77232 · Published 2021-05-28 · Partial fix · 1.4.17 CWE-502
Priority HIGH 72
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.99999 · Published 2021-12-18 · Partial fix · 2.17.0, 2.12.3 +5 CWE-20
Priority HIGH 70
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.41032 · Published 2015-08-13 · Partial fix · 2.4.4 CWE-74
Priority HIGH 69
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.8682 · Published 2019-04-19 · Partial fix · 3.4.0, 4.3.4 +3 CWE-1321
Priority HIGH 66
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.16628 · Published 2019-07-26 · Partial fix · 2.3.2 CWE-611
Priority MEDIUM 62
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI).
CVSS 3.0HIGH 8.2· Network · No auth · User interaction · EPSS 0.38222 · Published 2018-04-19 · No fix listed
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05373 · Published 2019-10-12 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05681 · Published 2019-10-01 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 56
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04741 · Published 2019-10-01 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 54
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09451 · Published 2019-04-17 · Fixed in 2.0.15 CWE-611
Priority MEDIUM 54
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.08401 · Published 2013-09-30 · Partial fix · 2.3.15.2 CWE-16
Priority MEDIUM 51
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.29726 · Published 2018-01-18 · Partial fix · 1.12.2, 3.0.0 +1 CWE-79
Priority MEDIUM 50
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00565 · Published 2026-10-20 · No fix listed CWE-287
Priority MEDIUM 50
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through t…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.08797 · Published 2018-10-18 · Partial fix · 5.1.1.RELEASE, 5.0.10.RELEASE +1
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00508 · Published 2026-07-21 · No fix listed CWE-284
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00508 · Published 2026-08-18 · No fix listed CWE-284
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00508 · Published 2026-07-21 · No fix listed CWE-284
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00508 · Published 2026-07-21 · No fix listed CWE-306
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00483 · Published 2026-06-16 · No fix listed CWE-306
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00483 · Published 2026-06-16 · No fix listed CWE-306
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-06-16 · No fix listed CWE-306
Priority MEDIUM 49
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00483 · Published 2026-06-16 · No fix listed CWE-306
Load more
THREATIST.IORead the docs