Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,348

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,237

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-78166	medium	5.3/10	provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection	Aug 24, 2026 yesterday
CVE-2026-78140	medium	5.1/10	Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine	Aug 23, 2026 2d ago
CVE-2026-49436	high	7.3/10	LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API	Aug 20, 2026 4d ago
CVE-2026-75987	medium	6.9/10	SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization	Aug 19, 2026 6d ago
CVE-2026-75979	medium	5.3/10	xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine	Aug 19, 2026 6d ago
CVE-2026-75936	high	7.5/10	Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java	Aug 18, 2026 7d ago
CVE-2026-75935	high	7.5/10	Memory-amplification denial of service via declared-length preallocation in Amazon ion-java	Aug 18, 2026 7d ago
CVE-2026-75876	medium	5.3/10	xianrendzw EasyReport Move Operations ModuleController.java sql injection	Aug 18, 2026 7d ago
CVE-2026-69220	high	8.7/10	RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS	Aug 18, 2026 7d ago
CVE-2026-63335	medium	6.3/10	RabbitMQ Java client malformed body frame triggers raw command assembler exception	Aug 18, 2026 7d ago
CVE-2026-59949	medium	6.5/10	yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)	Aug 18, 2026 7d ago
CVE-2026-74234	medium	5.1/10	Legora < 2026-08-14 XSS via Mermaid gray-matter JavaScript Engine	Aug 17, 2026 8d ago
CVE-2026-19828	medium	5.3/10	648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal	Aug 14, 2026 11d ago
CVE-2026-19827	medium	6.9/10	alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal	Aug 14, 2026 11d ago
CVE-2026-19761	medium	5.1/10	DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal	Aug 13, 2026 11d ago
CVE-2026-56858	—	—	Fix Javascript regexp context tracking in html/template	Aug 13, 2026 11d ago
CVE-2026-48791	low	2.0/10	Sigstore Java has a vulnerability with bundle verification of integratedTime	Aug 12, 2026 12d ago
CVE-2026-44401	medium	4.6/10	Typemill CMS 2.x Persistent XSS via Markdown javascript URI	Aug 10, 2026 15d ago
CVE-2026-71498	medium	5.1/10	node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript	Aug 6, 2026 18d ago
CVE-2026-48081	high	8.1/10	OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer	Aug 6, 2026 18d ago
CVE-2026-19110	medium	4.8/10	DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting	Aug 6, 2026 18d ago
CVE-2026-66683	medium	5.3/10	WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability	Aug 6, 2026 19d ago
CVE-2026-70609	medium	5.7/10	Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter	Aug 5, 2026 20d ago
CVE-2026-18903	medium	5.3/10	yeqifu warehouse FileController.java path traversal	Aug 5, 2026 20d ago
CVE-2026-10032	medium	6.1/10	Arbitrary JavaScript Execution via openUrl in @a2ui/web_core	Aug 4, 2026 21d ago
CVE-2026-69254	critical	9.4/10	Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override	Aug 4, 2026 21d ago
CVE-2026-18631	medium	5.3/10	jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization	Aug 3, 2026 22d ago
CVE-2026-67333	medium	5.1/10	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	Aug 1, 2026 24d ago
CVE-2026-62324	medium	5.4/10	Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS	Jul 31, 2026 25d ago
CVE-2026-67595	critical	9.2/10	VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php	Jul 29, 2026 26d ago