Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

344,180

All time

Critical · Active

11,533

CVSS ≥ 9.0

New · 14 days

2,691

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-71498	medium	5.1/10	node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript	Aug 6, 2026 today
CVE-2026-48081	high	8.1/10	OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer	Aug 6, 2026 today
CVE-2026-19110	medium	4.8/10	DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting	Aug 6, 2026 today
CVE-2026-66683	medium	5.3/10	WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability	Aug 6, 2026 today
CVE-2026-70609	medium	5.7/10	Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter	Aug 5, 2026 yesterday
CVE-2026-18903	medium	5.3/10	yeqifu warehouse FileController.java path traversal	Aug 5, 2026 2d ago
CVE-2026-10032	medium	6.1/10	Arbitrary JavaScript Execution via openUrl in @a2ui/web_core	Aug 4, 2026 2d ago
CVE-2026-69254	critical	9.4/10	Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override	Aug 4, 2026 2d ago
CVE-2026-18631	medium	5.3/10	jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization	Aug 3, 2026 3d ago
CVE-2026-67333	medium	5.1/10	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	Aug 1, 2026 5d ago
CVE-2026-62324	medium	5.4/10	Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS	Jul 31, 2026 6d ago
CVE-2026-67595	critical	9.2/10	VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php	Jul 29, 2026 8d ago
CVE-2026-66713	—	—	Apache Axis2/Java: deserialization of untrusted Data	Jul 28, 2026 9d ago
CVE-2026-66390	—	—	Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence	Jul 27, 2026 10d ago
CVE-2026-17459	medium	5.3/10	perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink	Jul 26, 2026 12d ago
CVE-2026-57530	medium	5.1/10	Milkdown < 7.21.3 Stored XSS via javascript: URL in link href	Jul 24, 2026 13d ago
CVE-2026-16392	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Jul 21, 2026 16d ago
CVE-2026-16355	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Jul 21, 2026 16d ago
CVE-2026-16369	—	—	Integer overflow in the JavaScript: WebAssembly component	Jul 21, 2026 16d ago
CVE-2026-16368	—	—	Incorrect boundary conditions in the JavaScript: WebAssembly component	Jul 21, 2026 16d ago
CVE-2026-16363	—	—	JIT miscompilation in the JavaScript: WebAssembly component	Jul 21, 2026 16d ago
CVE-2026-64609	—	—	Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization	Jul 21, 2026 17d ago
CVE-2026-16336	medium	5.3/10	trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect	Jul 21, 2026 17d ago
CVE-2026-16223	medium	5.3/10	1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery	Jul 19, 2026 19d ago
CVE-2026-16222	medium	5.3/10	1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery	Jul 19, 2026 19d ago
CVE-2025-71396	low	2.3/10	SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting	Jul 18, 2026 19d ago
CVE-2026-53597	high	8.7/10	Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader	Jul 16, 2026 21d ago
CVE-2026-15718	—	—	Invalid pointer in the JavaScript: WebAssembly component	Jul 14, 2026 23d ago
CVE-2026-55771	high	8.8/10	CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities	Jul 13, 2026 24d ago
CVE-2026-55773	high	8.8/10	CedarJava has a policy injection vulnerability	Jul 13, 2026 24d ago