Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

705

Newly disclosed

Feed last synced

8 hrs ago

Data freshness

Showing 121–150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-0636	medium	5.5/10	LDAP Injection Vulnerability in LDAPStoreHelper.java	Apr 15, 2026 2mo ago
CVE-2026-34161	medium	5.1/10	Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution	Apr 14, 2026 2mo ago
CVE-2026-27674	medium	6.1/10	Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)	Apr 14, 2026 2mo ago
CVE-2026-6224	medium	6.9/10	nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox	Apr 13, 2026 2mo ago
CVE-2026-6220	medium	5.1/10	HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery	Apr 13, 2026 2mo ago
CVE-2026-6105	medium	6.9/10	perfree go-fastdfs-web doInstall InstallController.java improper authorization	Apr 11, 2026 2mo ago
CVE-2026-35643	high	8.6/10	OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface	Apr 10, 2026 2mo ago
CVE-2026-5987	medium	5.1/10	Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine	Apr 9, 2026 2mo ago
CVE-2026-39911	high	8.7/10	Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE	Apr 9, 2026 2mo ago
CVE-2026-5802	medium	6.9/10	idachev mcp-javadc HTTP os command injection	Apr 8, 2026 2mo ago
CVE-2026-35568	high	7.6/10	MCP Java-SDK has a DNS Rebinding Vulnerability	Apr 7, 2026 2mo ago
CVE-2026-5736	medium	6.9/10	PowerJob detailPlus Endpoint InstanceController.java sql injection	Apr 7, 2026 2mo ago
CVE-2026-35608	medium	5.3/10	QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution	Apr 7, 2026 2mo ago
CVE-2026-5616	medium	6.9/10	JeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication	Apr 6, 2026 2mo ago
CVE-2026-5535	medium	5.3/10	FedML-AI FedML MQTT Message FileUtils.java path traversal	Apr 5, 2026 2mo ago
CVE-2026-34778	medium	5.9/10	Electron: Service worker can spoof executeJavaScript IPC replies	Apr 3, 2026 2mo ago
CVE-2026-5462	medium	4.8/10	Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key	Apr 3, 2026 2mo ago
CVE-2026-5458	medium	4.8/10	Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key	Apr 3, 2026 2mo ago
CVE-2026-5457	medium	4.8/10	PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key	Apr 3, 2026 2mo ago
CVE-2026-5456	medium	4.8/10	Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key	Apr 3, 2026 2mo ago
CVE-2026-5453	medium	4.8/10	Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key	Apr 3, 2026 2mo ago
CVE-2026-5452	medium	4.8/10	UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key	Apr 3, 2026 2mo ago
CVE-2026-5420	low	2.0/10	Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key	Apr 2, 2026 2mo ago
CVE-2026-5418	medium	6.9/10	appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery	Apr 2, 2026 2mo ago
CVE-2026-5328	medium	5.3/10	shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection	Apr 2, 2026 2mo ago
CVE-2026-34076	high	7.4/10	Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host	Apr 1, 2026 2mo ago
CVE-2026-5259	medium	5.3/10	AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery	Apr 1, 2026 2mo ago
CVE-2026-34449	critical	9.7/10	SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	Mar 31, 2026 2mo ago
CVE-2026-34237	medium	6.1/10	MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)	Mar 31, 2026 2mo ago
CVE-2026-34043	medium	5.9/10	Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects	Mar 31, 2026 2mo ago