Feed live

The CMS vulnerability ledger.

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-56091	high	8.2/10	Apache Shiro: Authentication bypass in Guice-Web integration	Jun 25, 2026 2d ago
CVE-2026-56130	low	2.0/10	Apache Shiro: Remember-me cookie isn't checked for expiry on the server	Jun 25, 2026 2d ago
CVE-2026-41566	critical	9.4/10	Apache Kvrocks: Improper permission for the APPLYBATCH command	Jun 25, 2026 2d ago
CVE-2026-45188	low	2.4/10	Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling	Jun 25, 2026 2d ago
CVE-2026-46751	medium	5.5/10	Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.	Jun 25, 2026 2d ago
CVE-2026-46752	critical	10.0/10	Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()	Jun 25, 2026 2d ago
CVE-2026-54226	medium	6.4/10	Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS	Jun 25, 2026 2d ago
CVE-2025-62198	—	—	Apache Atlas: Stored XSS in Create Entity page	Jun 22, 2026 5d ago
CVE-2026-44914	high	7.5/10	Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents	Jun 22, 2026 5d ago
CVE-2026-44911	low	2.3/10	Apache NiFi: Incorrect Authorization for Configuration Verification Requests	Jun 22, 2026 5d ago
CVE-2026-44913	medium	5.2/10	Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL	Jun 22, 2026 5d ago
CVE-2026-54665	medium	6.3/10	Apache NiFi: Missing Validation for Proxy Host Headers	Jun 22, 2026 5d ago
CVE-2025-66336	—	—	Apache Doris MCP Server: SQL injection leading the authentication bypass	Jun 22, 2026 5d ago
CVE-2026-47340	—	—	Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.	Jun 17, 2026 10d ago
CVE-2026-32967	—	—	Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks	Jun 17, 2026 10d ago
CVE-2026-42357	—	—	Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.	Jun 17, 2026 10d ago
CVE-2026-41280	—	—	Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects	Jun 17, 2026 10d ago
CVE-2026-32966	—	—	Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure	Jun 17, 2026 10d ago
CVE-2026-50645	—	—	Apache CXF: No restriction on attachment headers per message	Jun 12, 2026 15d ago
CVE-2026-50634	—	—	Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry	Jun 12, 2026 15d ago
CVE-2026-50633	—	—	Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl	Jun 12, 2026 15d ago
CVE-2026-50632	—	—	Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory	Jun 12, 2026 15d ago
CVE-2026-50631	—	—	Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing	Jun 12, 2026 15d ago
CVE-2026-50630	—	—	Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection	Jun 12, 2026 15d ago
CVE-2026-50629	—	—	Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier	Jun 12, 2026 15d ago
CVE-2026-50628	—	—	Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control	Jun 12, 2026 15d ago
CVE-2026-50627	—	—	Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator	Jun 12, 2026 15d ago
CVE-2026-49875	—	—	Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils	Jun 12, 2026 15d ago
CVE-2026-50623	—	—	Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService	Jun 12, 2026 15d ago
CVE-2026-47342	—	—	Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass	Jun 10, 2026 16d ago