Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,359

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,231

Newly disclosed

Feed last synced

58 mins ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-46584	—	—	Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters	Jul 6, 2026 1mo ago
CVE-2026-43865	—	—	Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution	Jul 6, 2026 1mo ago
CVE-2026-42527	—	—	Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure	Jul 6, 2026 1mo ago
CVE-2026-40859	—	—	Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled	Jul 6, 2026 1mo ago
CVE-2026-14759	medium	4.8/10	radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow	Jul 5, 2026 1mo ago
CVE-2026-14686	medium	4.8/10	HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison	Jul 5, 2026 1mo ago
CVE-2026-14685	medium	4.8/10	HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issue	Jul 4, 2026 1mo ago
CVE-2026-14684	medium	4.8/10	HdrHistogram AbstractHistogram.java memory allocation	Jul 4, 2026 1mo ago
CVE-2026-14683	medium	4.8/10	HdrHistogram AbstractHistogram.java memory allocation	Jul 4, 2026 1mo ago
CVE-2026-14621	low	2.3/10	FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session	Jul 4, 2026 1mo ago
CVE-2026-55791	medium	6.9/10	Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs	Jul 1, 2026 1mo ago
CVE-2026-54712	medium	5.3/10	OpenTelemetry Javaagent RMI context propagation allows resource exhaustion	Jul 1, 2026 1mo ago
CVE-2026-54704	medium	6.5/10	OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords	Jul 1, 2026 1mo ago
CVE-2026-58038	—	0.0/10	Stored XSS through javascript URLs in SVGs generated by EasyTimeline	Jul 1, 2026 1mo ago
CVE-2026-56264	critical	9.2/10	Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint	Jun 30, 2026 1mo ago
CVE-2026-10585	medium	6.3/10	Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category	Jun 30, 2026 1mo ago
CVE-2026-54889	medium	5.1/10	Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)	Jun 29, 2026 1mo ago
CVE-2026-12856	high	8.8/10	Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension	Jun 29, 2026 1mo ago
CVE-2026-13528	medium	6.9/10	YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal	Jun 29, 2026 1mo ago
CVE-2026-13503	medium	6.9/10	antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal	Jun 28, 2026 1mo ago
CVE-2026-13502	low	2.0/10	antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou	Jun 28, 2026 1mo ago
CVE-2026-13500	medium	6.9/10	antlr ANTLR4 Grammar Action Block OutputFile.java code injection	Jun 28, 2026 1mo ago
CVE-2026-12321	—	—	JIT miscompilation in the JavaScript: WebAssembly component	Jun 16, 2026 2mo ago
CVE-2026-12057	high	8.6/10	DoS + Remote Code Execution via PDF JavaScript in Foxit AI	Jun 15, 2026 2mo ago
CVE-2026-53606	medium	5.4/10	sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes	Jun 12, 2026 2mo ago
CVE-2026-45011	high	7.3/10	Apostrophe has stored XSS via javascript: URL in Image Widget Link	Jun 12, 2026 2mo ago
CVE-2026-53722	medium	5.1/10	Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL	Jun 12, 2026 2mo ago
CVE-2026-11933	high	8.8/10	Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion	Jun 12, 2026 2mo ago
CVE-2026-46625	high	7.5/10	JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection	Jun 10, 2026 2mo ago
CVE-2026-53473	high	7.3/10	Migration-planner-ui-app: stored xss via javascript: url in agent credential link	Jun 10, 2026 2mo ago