Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

6 hrs ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-8736	low	2.4/10	Oinone Pamirs RestController LocalFileClient.java request.getParameter path traversal	May 17, 2026 1mo ago
CVE-2026-8735	medium	5.3/10	Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization	May 17, 2026 1mo ago
CVE-2026-8724	medium	5.1/10	Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection	May 17, 2026 1mo ago
CVE-2026-44371	medium	5.3/10	Open OnDemand: Specially crafted filenames can execute javascript in the file browser	May 14, 2026 1mo ago
CVE-2026-33117	critical	9.1/10	Azure SDK for Java Security Feature Bypass Vulnerability	May 12, 2026 1mo ago
CVE-2026-43939	high	7.3/10	YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers	May 12, 2026 1mo ago
CVE-2026-8391	—	—	Other issue in the JavaScript Engine component	May 12, 2026 1mo ago
CVE-2026-8390	—	—	Use-after-free in the JavaScript: WebAssembly component	May 12, 2026 1mo ago
CVE-2026-8389	—	—	JIT miscompilation in the JavaScript Engine: JIT component	May 12, 2026 1mo ago
CVE-2026-8388	—	—	Incorrect boundary conditions in the JavaScript Engine: JIT component	May 12, 2026 1mo ago
CVE-2026-43878	medium	6.1/10	WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal	May 11, 2026 1mo ago
CVE-2026-43874	high	7.2/10	WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass	May 11, 2026 1mo ago
CVE-2026-8320	medium	5.1/10	jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery	May 11, 2026 1mo ago
CVE-2026-34095	—	0.0/10	action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request	May 11, 2026 1mo ago
CVE-2026-8216	medium	6.9/10	Industrial Application Software IAS Canias ERP Java RMI Session Management iasServerRemoteInterface.doAction improper authentication	May 10, 2026 1mo ago
CVE-2026-8211	medium	5.1/10	codelibs Fess JSP File AdminDesignAction.java update code injection	May 9, 2026 1mo ago
CVE-2026-8196	medium	6.3/10	JeecgBoot mLogin Endpoint LoginController.java authorization	May 9, 2026 1mo ago
CVE-2026-8195	medium	5.3/10	JeecgBoot SVG File CommonController.java cross site scripting	May 9, 2026 1mo ago
CVE-2026-41512	critical	9.9/10	Remote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`	May 8, 2026 1mo ago
CVE-2026-8127	medium	5.3/10	eladmin Users API Endpoint UserController.java checkLevel access control	May 8, 2026 1mo ago
CVE-2026-41692	medium	4.7/10	i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes	May 7, 2026 1mo ago
CVE-2026-41586	critical	9.3/10	ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE	May 7, 2026 1mo ago
CVE-2026-42509	—	—	Apache Wicket: crafted strings can break out of the JavaScript sequence	May 6, 2026 1mo ago
CVE-2026-43869	—	—	Apache Thrift: TSSLTransportFactory.java hostname verification	May 5, 2026 1mo ago
CVE-2026-7710	medium	6.9/10	YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication	May 3, 2026 1mo ago
CVE-2026-7699	medium	5.3/10	Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection	May 3, 2026 1mo ago
CVE-2026-7679	medium	6.9/10	YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication	May 3, 2026 1mo ago
CVE-2026-7678	medium	5.3/10	YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection	May 3, 2026 1mo ago
CVE-2026-7677	medium	5.1/10	kerwincui FastBee System Notice SysNoticeController.java add cross site scripting	May 3, 2026 1mo ago
CVE-2026-7676	medium	5.3/10	kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal	May 3, 2026 1mo ago