Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,348

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,237

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66713	—	—	Apache Axis2/Java: deserialization of untrusted Data	Jul 28, 2026 28d ago
CVE-2026-66390	—	—	Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence	Jul 27, 2026 29d ago
CVE-2026-17459	medium	5.3/10	perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink	Jul 26, 2026 1mo ago
CVE-2026-57530	medium	5.1/10	Milkdown < 7.21.3 Stored XSS via javascript: URL in link href	Jul 24, 2026 1mo ago
CVE-2026-16392	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Jul 21, 2026 1mo ago
CVE-2026-16355	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Jul 21, 2026 1mo ago
CVE-2026-16369	—	—	Integer overflow in the JavaScript: WebAssembly component	Jul 21, 2026 1mo ago
CVE-2026-16368	—	—	Incorrect boundary conditions in the JavaScript: WebAssembly component	Jul 21, 2026 1mo ago
CVE-2026-16363	—	—	JIT miscompilation in the JavaScript: WebAssembly component	Jul 21, 2026 1mo ago
CVE-2026-64609	—	—	Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization	Jul 21, 2026 1mo ago
CVE-2026-16336	medium	5.3/10	trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect	Jul 21, 2026 1mo ago
CVE-2026-16223	medium	5.3/10	1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery	Jul 19, 2026 1mo ago
CVE-2026-16222	medium	5.3/10	1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery	Jul 19, 2026 1mo ago
CVE-2025-71396	low	2.3/10	SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting	Jul 18, 2026 1mo ago
CVE-2026-53597	high	8.7/10	Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader	Jul 16, 2026 1mo ago
CVE-2026-15718	—	—	Invalid pointer in the JavaScript: WebAssembly component	Jul 14, 2026 1mo ago
CVE-2026-55771	high	8.8/10	CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities	Jul 13, 2026 1mo ago
CVE-2026-55773	high	8.8/10	CedarJava has a policy injection vulnerability	Jul 13, 2026 1mo ago
CVE-2026-15326	medium	5.1/10	halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal	Jul 10, 2026 1mo ago
CVE-2026-55760	high	7.5/10	handlebars.java FileTemplateLoader Path Traversal	Jul 8, 2026 1mo ago
CVE-2026-59929	medium	6.1/10	Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution	Jul 8, 2026 1mo ago
CVE-2026-59892	high	7.5/10	OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header	Jul 8, 2026 1mo ago
CVE-2026-41042	—	—	Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter	Jul 8, 2026 1mo ago
CVE-2026-56812	medium	6.3/10	Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff	Jul 7, 2026 1mo ago
CVE-2026-53641	medium	4.8/10	FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal	Jul 6, 2026 1mo ago
CVE-2026-43825	—	—	Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel	Jul 6, 2026 1mo ago
CVE-2026-43867	—	—	Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter	Jul 6, 2026 1mo ago
CVE-2026-56139	—	—	Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients	Jul 6, 2026 1mo ago
CVE-2026-49365	—	—	Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients	Jul 6, 2026 1mo ago
CVE-2026-46590	—	—	Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)	Jul 6, 2026 1mo ago