Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

5 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-10529	medium	4.8/10	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	Jun 2, 2026 25d ago
CVE-2026-10514	medium	4.8/10	1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting	Jun 1, 2026 25d ago
CVE-2026-9309	—	—	Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection	Jun 1, 2026 26d ago
CVE-2026-9308	—	—	Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order	Jun 1, 2026 26d ago
CVE-2026-10204	medium	5.3/10	OFCMS JSON Query SysUserController.java query sql injection	May 31, 2026 26d ago
CVE-2026-10203	medium	5.3/10	OFCMS JSON Query SystemParamController.java query sql injection	May 31, 2026 26d ago
CVE-2026-10202	medium	5.3/10	OFCMS JSON Query SystemDictController.java query sql injection	May 31, 2026 26d ago
CVE-2026-10193	medium	5.3/10	OFCMS ComnController ComnController.java query sql injection	May 31, 2026 26d ago
CVE-2026-10153	medium	5.3/10	westboy CicadasCMS AbstractCacheManager.java search cross site scripting	May 30, 2026 27d ago
CVE-2026-10152	medium	5.3/10	TaleLin lin-cms-spring-boot book Endpoint BookController.java access control	May 30, 2026 27d ago
CVE-2026-45292	medium	5.3/10	opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation	May 28, 2026 29d ago
CVE-2026-9828	low	2.9/10	Logback deserialization whitelist bypass for java.lang and java.util	May 28, 2026 1mo ago
CVE-2026-9370	medium	6.3/10	ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt	May 24, 2026 1mo ago
CVE-2026-39964	medium	5.4/10	TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers	May 22, 2026 1mo ago
CVE-2026-5090	—	—	Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected	May 19, 2026 1mo ago
CVE-2026-33741	medium	6.8/10	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript	May 19, 2026 1mo ago
CVE-2026-8711	high	8.1/10	NGINX JavaScript vulnerability	May 19, 2026 1mo ago
CVE-2026-8830	medium	4.3/10	Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation	May 19, 2026 1mo ago
CVE-2026-3471	medium	6.5/10	Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App	May 18, 2026 1mo ago
CVE-2026-8773	medium	5.1/10	linlinjava litemall Database Setting DbUtil.java load argument injection	May 18, 2026 1mo ago
CVE-2026-8772	medium	5.1/10	linlinjava litemall Admin Endpoint sql injection	May 17, 2026 1mo ago
CVE-2026-8771	medium	6.9/10	linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection	May 17, 2026 1mo ago
CVE-2026-8759	medium	6.9/10	xiandafu beetl SpELFunction SpELFunction.java expression language injection	May 17, 2026 1mo ago
CVE-2026-8752	medium	6.9/10	h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control	May 17, 2026 1mo ago
CVE-2026-8751	medium	6.9/10	h2oai h2o-3 JAR Model.java importBinaryModel deserialization	May 17, 2026 1mo ago
CVE-2026-8750	medium	6.9/10	h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure	May 17, 2026 1mo ago
CVE-2026-8740	medium	5.3/10	Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine	May 17, 2026 1mo ago
CVE-2026-8739	medium	6.9/10	Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key	May 17, 2026 1mo ago
CVE-2026-8738	medium	6.9/10	Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error	May 17, 2026 1mo ago
CVE-2026-8737	medium	6.9/10	Sanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication	May 17, 2026 1mo ago