Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,359

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,218

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-40993	high	7.3/10	Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry	Jun 9, 2026 2mo ago
CVE-2026-41845	high	7.1/10	Spring Framework Cross-site Scripting via JavaScriptUtils	Jun 9, 2026 2mo ago
CVE-2026-11618	medium	6.9/10	DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication	Jun 9, 2026 2mo ago
CVE-2026-44746	medium	6.1/10	Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet)	Jun 9, 2026 2mo ago
CVE-2026-40128	critical	9.0/10	Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)	Jun 9, 2026 2mo ago
CVE-2026-45581	medium	5.5/10	fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode	Jun 8, 2026 2mo ago
CVE-2026-11521	medium	5.3/10	Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization	Jun 8, 2026 2mo ago
CVE-2026-11502	low	2.3/10	JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect	Jun 8, 2026 2mo ago
CVE-2026-11477	medium	5.3/10	hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect	Jun 8, 2026 2mo ago
CVE-2026-11473	medium	5.3/10	jflyfox jfinal_cms AdvicefeedbackController.java list sql injection	Jun 8, 2026 2mo ago
CVE-2026-11470	medium	5.3/10	hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal	Jun 8, 2026 2mo ago
CVE-2026-11469	medium	5.1/10	jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery	Jun 7, 2026 2mo ago
CVE-2026-11467	medium	5.3/10	jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal	Jun 7, 2026 2mo ago
CVE-2026-11464	low	2.3/10	JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure	Jun 7, 2026 2mo ago
CVE-2026-46496	critical	9.3/10	HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft	Jun 5, 2026 2mo ago
CVE-2026-50076	—	—	Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass	Jun 4, 2026 2mo ago
CVE-2026-10771	medium	6.9/10	crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery	Jun 3, 2026 2mo ago
CVE-2026-10702	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Jun 2, 2026 2mo ago
CVE-2026-33245	high	8.0/10	React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets	Jun 2, 2026 2mo ago
CVE-2026-45683	low	3.8/10	OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure	Jun 2, 2026 2mo ago
CVE-2026-10567	medium	5.1/10	1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting	Jun 2, 2026 2mo ago
CVE-2026-10550	medium	5.3/10	elunez eladmin Application Deployment App.java command injection	Jun 2, 2026 2mo ago
CVE-2026-10529	medium	4.8/10	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	Jun 2, 2026 2mo ago
CVE-2026-10514	medium	4.8/10	1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting	Jun 1, 2026 2mo ago
CVE-2026-9309	—	—	Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection	Jun 1, 2026 2mo ago
CVE-2026-9308	—	—	Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order	Jun 1, 2026 2mo ago
CVE-2026-10204	medium	5.3/10	OFCMS JSON Query SysUserController.java query sql injection	May 31, 2026 2mo ago
CVE-2026-10203	medium	5.3/10	OFCMS JSON Query SystemParamController.java query sql injection	May 31, 2026 2mo ago
CVE-2026-10202	medium	5.3/10	OFCMS JSON Query SystemDictController.java query sql injection	May 31, 2026 2mo ago
CVE-2026-10193	medium	5.3/10	OFCMS ComnController ComnController.java query sql injection	May 31, 2026 2mo ago