Priority CRITICAL 100KEV
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request para…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.93039 · Published 2016-06-07 · Partial fix · 1.2.5 CWE-321
Priority CRITICAL 100KEV
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99906 · Published 2015-02-17 · Fixed in 1.3.8, 1.4.3 CWE-284
Priority CRITICAL 94KEV
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.99968 · Published 2017-10-03 · Partial fix · 9.0.1, 8.5.23 +2 CWE-434
Priority CRITICAL 91
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.89358 · Published 2017-04-17 · Partial fix · 2.8.2 CWE-502
Priority CRITICAL 88
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.77476 · Published 2018-04-06 · Partial fix · 5.0.5.RELEASE, 4.3.16.RELEASE CWE-94
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority MEDIUM 50
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00735 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority MEDIUM 48
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.04364 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-289
Priority MEDIUM 47
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04928 · Published 2017-04-29 · Partial fix · 1.4.10 CWE-20
Priority MEDIUM 44
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03089 · Published 2019-11-25 · Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
Priority MEDIUM 43
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-611
Priority MEDIUM 43
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority MEDIUM 43
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02461 · Published 2018-05-11 · Fixed in 5.0.6.RELEASE CWE-863
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00719 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 40
A vulnerability was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04572 · Published 2024-02-19 · Partial fix · 1.5.5.016-1.redhat_00001.1.ep7.el7, 1:1.5.5.016-1.redhat_00001.1.ep7.el7 +24 CWE-400
Priority LOW 39
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activa…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00925 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority LOW 39
A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2…
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.02712 · Published 2019-03-25 · Fixed in 1.4.3, 1.5.3 +2
Priority LOW 39
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.09712 · Published 2019-05-23 · Partial fix · 3.4.14, 3.5.5 CWE-862
Priority LOW 38
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowe…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00697 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority LOW 38
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0051 · Published 2026-06-09 · Partial fix · 4.0.5.1, 3.3.15.1 +5 CWE-502
Priority LOW 36
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01771 · Published 2023-09-14 · Partial fix · 2.3.5, 2.2.24 +18 CWE-835
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01774 · Published 2022-08-23 · Partial fix · 2.0.40, 2.2.10 CWE-400
Priority LOW 33
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02126 · Published 2020-07-06 · Partial fix · 5.3.18, 5.4.18 +1 CWE-89
Load more
THREATIST.IORead the docs