Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,373

All time

Critical · Active

12,004

CVSS ≥ 9.0

New · 14 days

2,196

Newly disclosed

Feed last synced

44 mins ago

Data freshness

Showing 361–390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-2141	medium	5.3/10	WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization	Feb 8, 2026 6mo ago
CVE-2026-2107	medium	5.3/10	yeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2106	medium	5.3/10	yeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2105	medium	5.3/10	yeqifu warehouse Department Management DeptController.java deleteDept improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2079	medium	5.3/10	yeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2078	medium	5.3/10	yeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2077	medium	5.3/10	yeqifu warehouse Role Management RoleController.java deleteRole improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2076	medium	5.3/10	yeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization	Feb 7, 2026 6mo ago
CVE-2026-2075	medium	5.3/10	yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control	Feb 7, 2026 6mo ago
CVE-2026-25516	medium	6.1/10	NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content	Feb 6, 2026 6mo ago
CVE-2026-2010	low	2.3/10	Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization	Feb 6, 2026 6mo ago
CVE-2026-25526	critical	9.8/10	JinJava Bypass through ForTag leads to Arbitrary Java Execution	Feb 4, 2026 6mo ago
CVE-2026-1813	medium	5.3/10	bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload	Feb 3, 2026 6mo ago
CVE-2026-1812	medium	5.3/10	bolo-blog bolo-solo Filename BackupService.java importFromCnblogs path traversal	Feb 3, 2026 6mo ago
CVE-2026-1811	medium	5.3/10	bolo-blog bolo-solo Filename BackupService.java importFromMarkdown path traversal	Feb 3, 2026 6mo ago
CVE-2026-1810	medium	5.3/10	bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal	Feb 3, 2026 6mo ago
CVE-2026-1814	medium	6.8/10	Rapid7 Nexpose Insecure Java Keystore Password Generation	Feb 3, 2026 6mo ago
CVE-2025-67484	—	0.0/10	Action API xslt option allows JavaScript execution by administrators who are not interface administrators	Feb 3, 2026 6mo ago
CVE-2026-24737	high	8.1/10	jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution	Feb 2, 2026 6mo ago
CVE-2025-7105	medium	5.7/10	Denial of Service via JavaScript Memory Overflow in danny-avila/librechat	Feb 2, 2026 6mo ago
CVE-2026-1691	medium	5.3/10	bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization	Jan 30, 2026 6mo ago
CVE-2026-25117	high	8.3/10	pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution	Jan 29, 2026 6mo ago
CVE-2026-1406	medium	5.1/10	lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin	Jan 25, 2026 7mo ago
CVE-2026-1191	medium	4.4/10	JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	Jan 24, 2026 7mo ago
CVE-2026-24474	medium	5.3/10	Dioxus Components has JavaScript injection via user-supplied IDs	Jan 23, 2026 7mo ago
CVE-2026-1126	medium	5.3/10	lwj flow SVG File FormResource.java uploadFile unrestricted upload	Jan 18, 2026 7mo ago
CVE-2026-1112	medium	5.3/10	Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization	Jan 18, 2026 7mo ago
CVE-2026-1111	medium	5.1/10	Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal	Jan 18, 2026 7mo ago
CVE-2026-1064	medium	5.1/10	bastillion-io Bastillion System Management SystemKtrl.java command injection	Jan 17, 2026 7mo ago
CVE-2026-1063	medium	5.1/10	bastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injection	Jan 17, 2026 7mo ago