Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

705

Newly disclosed

Feed last synced

10 hrs ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-33941	high	8.3/10	Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options	Mar 27, 2026 3mo ago
CVE-2026-33940	high	8.1/10	Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial	Mar 27, 2026 3mo ago
CVE-2026-33938	high	8.1/10	Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block	Mar 27, 2026 3mo ago
CVE-2026-33937	critical	9.8/10	Handlebars.js has JavaScript Injection via AST Type Confusion	Mar 27, 2026 3mo ago
CVE-2026-4954	medium	5.3/10	mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection	Mar 27, 2026 3mo ago
CVE-2026-4953	medium	6.9/10	mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery	Mar 27, 2026 3mo ago
CVE-2026-33728	critical	9.3/10	dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution	Mar 27, 2026 3mo ago
CVE-2026-33622	medium	6.1/10	A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution	Mar 26, 2026 3mo ago
CVE-2026-4860	medium	6.9/10	648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization	Mar 26, 2026 3mo ago
CVE-2026-33349	medium	5.9/10	fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation	Mar 24, 2026 3mo ago
CVE-2026-23919	high	7.1/10	Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server	Mar 24, 2026 3mo ago
CVE-2026-4716	—	—	Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component	Mar 24, 2026 3mo ago
CVE-2026-4723	—	—	Use-after-free in the JavaScript Engine component	Mar 24, 2026 3mo ago
CVE-2026-4702	—	—	JIT miscompilation in the JavaScript Engine component	Mar 24, 2026 3mo ago
CVE-2026-4701	—	—	Use-after-free in the JavaScript Engine component	Mar 24, 2026 3mo ago
CVE-2026-4698	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Mar 24, 2026 3mo ago
CVE-2026-4597	medium	5.3/10	648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection	Mar 23, 2026 3mo ago
CVE-2026-4594	medium	6.9/10	erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injection	Mar 23, 2026 3mo ago
CVE-2026-4593	medium	5.3/10	erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection	Mar 23, 2026 3mo ago
CVE-2026-33500	medium	5.4/10	AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization	Mar 23, 2026 3mo ago
CVE-2026-4586	medium	5.3/10	CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload	Mar 23, 2026 3mo ago
CVE-2026-33140	medium	5.3/10	PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution	Mar 20, 2026 3mo ago
CVE-2026-4495	medium	5.1/10	atjiu pybbs CommentApiController.java create cross site scripting	Mar 20, 2026 3mo ago
CVE-2026-4494	medium	5.1/10	atjiu pybbs TopicApiController.java create cross site scripting	Mar 20, 2026 3mo ago
CVE-2026-33395	medium	4.4/10	Discourse has stored click‑based XSS via Graphviz SVG javascript: links	Mar 19, 2026 3mo ago
CVE-2026-4285	medium	5.1/10	taoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversal	Mar 16, 2026 3mo ago
CVE-2026-4284	medium	5.1/10	taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery	Mar 16, 2026 3mo ago
CVE-2026-4243	low	2.0/10	La Nacion App app.lanacion.activity BuildConfig.java credentials storage	Mar 16, 2026 3mo ago
CVE-2026-4242	low	2.0/10	BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage	Mar 16, 2026 3mo ago
CVE-2026-4219	medium	4.8/10	INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentials	Mar 16, 2026 3mo ago