Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

706

Newly disclosed

Feed last synced

7 hrs ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-7673	medium	5.1/10	crmeb_java Admin Upload UploadServiceImpl.java unrestricted upload	May 3, 2026 1mo ago
CVE-2026-7672	medium	5.3/10	youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection	May 3, 2026 1mo ago
CVE-2026-7605	medium	5.3/10	JeecgBoot uploadImgByHttpEndpoint CommonController.java HttpFileToMultipartFileUtil.downloadImageData server-side request forgery	May 2, 2026 1mo ago
CVE-2026-7604	medium	5.3/10	JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery	May 2, 2026 1mo ago
CVE-2026-7306	medium	6.3/10	Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key	Apr 28, 2026 1mo ago
CVE-2026-7305	medium	5.3/10	Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery	Apr 28, 2026 1mo ago
CVE-2026-7303	medium	6.3/10	Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection	Apr 28, 2026 1mo ago
CVE-2026-7292	medium	6.3/10	o2oa NodeAgent NodeAgent.java syncFile improper authorization	Apr 28, 2026 1mo ago
CVE-2026-7291	medium	5.3/10	o2oa URL Fetching FileAction.java FileAction server-side request forgery	Apr 28, 2026 1mo ago
CVE-2026-7290	medium	5.3/10	JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection	Apr 28, 2026 2mo ago
CVE-2026-41603	—	—	Apache Thrift: Java TSSLTransportFactory hostname verification	Apr 28, 2026 2mo ago
CVE-2026-27172	—	—	Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store	Apr 27, 2026 2mo ago
CVE-2026-7060	medium	6.9/10	liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection	Apr 26, 2026 2mo ago
CVE-2026-7045	medium	5.3/10	baomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injection	Apr 26, 2026 2mo ago
CVE-2026-7024	medium	5.3/10	rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal	Apr 26, 2026 2mo ago
CVE-2026-7018	medium	6.3/10	Datavane Datavines JWT Token TokenManager.java hard-coded key	Apr 26, 2026 2mo ago
CVE-2026-41248	critical	9.1/10	Official Clerk JavaScript SDKs: Middleware-based route protection bypass	Apr 24, 2026 2mo ago
CVE-2026-41433	high	8.4/10	OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR	Apr 24, 2026 2mo ago
CVE-2026-40927	medium	5.4/10	Docmost: XSS in Comments with JavaScript URI	Apr 21, 2026 2mo ago
CVE-2026-6797	medium	5.3/10	Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption	Apr 21, 2026 2mo ago
CVE-2026-6796	medium	5.3/10	Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file	Apr 21, 2026 2mo ago
CVE-2026-40911	critical	10.0/10	WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks	Apr 21, 2026 2mo ago
CVE-2026-6779	—	—	Other issue in the JavaScript Engine component	Apr 21, 2026 2mo ago
CVE-2026-6758	—	—	Use-after-free in the JavaScript: WebAssembly component	Apr 21, 2026 2mo ago
CVE-2026-6757	—	—	Invalid pointer in the JavaScript: WebAssembly component	Apr 21, 2026 2mo ago
CVE-2026-6754	—	—	Use-after-free in the JavaScript Engine component	Apr 21, 2026 2mo ago
CVE-2026-6625	medium	6.9/10	moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery	Apr 20, 2026 2mo ago
CVE-2026-6620	medium	5.3/10	SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal	Apr 20, 2026 2mo ago
CVE-2026-40322	critical	9.1/10	SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE	Apr 16, 2026 2mo ago
CVE-2026-33220	medium	6.8/10	Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository	Apr 15, 2026 2mo ago