Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,367

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,225

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 181–210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-7291	medium	5.3/10	o2oa URL Fetching FileAction.java FileAction server-side request forgery	Apr 28, 2026 3mo ago
CVE-2026-7290	medium	5.3/10	JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection	Apr 28, 2026 3mo ago
CVE-2026-41603	—	—	Apache Thrift: Java TSSLTransportFactory hostname verification	Apr 28, 2026 3mo ago
CVE-2026-27172	—	—	Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store	Apr 27, 2026 4mo ago
CVE-2026-7060	medium	6.9/10	liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection	Apr 26, 2026 4mo ago
CVE-2026-7045	medium	5.3/10	baomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injection	Apr 26, 2026 4mo ago
CVE-2026-7024	medium	5.3/10	rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal	Apr 26, 2026 4mo ago
CVE-2026-7018	medium	6.3/10	Datavane Datavines JWT Token TokenManager.java hard-coded key	Apr 26, 2026 4mo ago
CVE-2026-41248	critical	9.1/10	Official Clerk JavaScript SDKs: Middleware-based route protection bypass	Apr 24, 2026 4mo ago
CVE-2026-41433	high	8.4/10	OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR	Apr 24, 2026 4mo ago
CVE-2026-40927	medium	5.4/10	Docmost: XSS in Comments with JavaScript URI	Apr 21, 2026 4mo ago
CVE-2026-6797	medium	5.3/10	Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption	Apr 21, 2026 4mo ago
CVE-2026-6796	medium	5.3/10	Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file	Apr 21, 2026 4mo ago
CVE-2026-40911	critical	10.0/10	WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks	Apr 21, 2026 4mo ago
CVE-2026-6779	—	—	Other issue in the JavaScript Engine component	Apr 21, 2026 4mo ago
CVE-2026-6758	—	—	Use-after-free in the JavaScript: WebAssembly component	Apr 21, 2026 4mo ago
CVE-2026-6757	—	—	Invalid pointer in the JavaScript: WebAssembly component	Apr 21, 2026 4mo ago
CVE-2026-6754	—	—	Use-after-free in the JavaScript Engine component	Apr 21, 2026 4mo ago
CVE-2026-6625	medium	6.9/10	moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery	Apr 20, 2026 4mo ago
CVE-2026-6620	medium	5.3/10	SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal	Apr 20, 2026 4mo ago
CVE-2026-40322	critical	9.1/10	SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE	Apr 16, 2026 4mo ago
CVE-2026-33220	medium	6.8/10	Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository	Apr 15, 2026 4mo ago
CVE-2026-0636	medium	5.5/10	LDAP Injection Vulnerability in LDAPStoreHelper.java	Apr 15, 2026 4mo ago
CVE-2026-34161	medium	5.1/10	Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution	Apr 14, 2026 4mo ago
CVE-2026-27674	medium	6.1/10	Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)	Apr 14, 2026 4mo ago
CVE-2026-6224	medium	6.9/10	nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox	Apr 13, 2026 4mo ago
CVE-2026-6220	medium	5.1/10	HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery	Apr 13, 2026 4mo ago
CVE-2026-6105	medium	6.9/10	perfree go-fastdfs-web doInstall InstallController.java improper authorization	Apr 11, 2026 4mo ago
CVE-2026-35643	high	8.6/10	OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface	Apr 10, 2026 4mo ago
CVE-2026-5987	medium	5.1/10	Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine	Apr 9, 2026 4mo ago