Feed live

java CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,368

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,217

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-39911	high	8.7/10	Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE	Apr 9, 2026 4mo ago
CVE-2026-5802	medium	6.9/10	idachev mcp-javadc HTTP os command injection	Apr 8, 2026 4mo ago
CVE-2026-35568	high	7.6/10	MCP Java-SDK has a DNS Rebinding Vulnerability	Apr 7, 2026 4mo ago
CVE-2026-5736	medium	6.9/10	PowerJob detailPlus Endpoint InstanceController.java sql injection	Apr 7, 2026 4mo ago
CVE-2026-35608	medium	5.3/10	QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution	Apr 7, 2026 4mo ago
CVE-2026-5616	medium	6.9/10	JeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication	Apr 6, 2026 4mo ago
CVE-2026-5535	medium	5.3/10	FedML-AI FedML MQTT Message FileUtils.java path traversal	Apr 5, 2026 4mo ago
CVE-2026-34778	medium	5.9/10	Electron: Service worker can spoof executeJavaScript IPC replies	Apr 3, 2026 4mo ago
CVE-2026-5462	medium	4.8/10	Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key	Apr 3, 2026 4mo ago
CVE-2026-5458	medium	4.8/10	Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key	Apr 3, 2026 4mo ago
CVE-2026-5457	medium	4.8/10	PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key	Apr 3, 2026 4mo ago
CVE-2026-5456	medium	4.8/10	Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key	Apr 3, 2026 4mo ago
CVE-2026-5453	medium	4.8/10	Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key	Apr 3, 2026 4mo ago
CVE-2026-5452	medium	4.8/10	UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key	Apr 3, 2026 4mo ago
CVE-2026-5420	low	2.0/10	Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key	Apr 2, 2026 4mo ago
CVE-2026-5418	medium	6.9/10	appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery	Apr 2, 2026 4mo ago
CVE-2026-5328	medium	5.3/10	shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection	Apr 2, 2026 4mo ago
CVE-2026-34076	high	7.4/10	Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host	Apr 1, 2026 4mo ago
CVE-2026-5259	medium	5.3/10	AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery	Apr 1, 2026 4mo ago
CVE-2026-34449	critical	9.7/10	SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection	Mar 31, 2026 4mo ago
CVE-2026-34237	medium	6.1/10	MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)	Mar 31, 2026 4mo ago
CVE-2026-34043	medium	5.9/10	Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects	Mar 31, 2026 4mo ago
CVE-2026-33941	high	8.3/10	Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options	Mar 27, 2026 5mo ago
CVE-2026-33940	high	8.1/10	Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial	Mar 27, 2026 5mo ago
CVE-2026-33938	high	8.1/10	Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block	Mar 27, 2026 5mo ago
CVE-2026-33937	critical	9.8/10	Handlebars.js has JavaScript Injection via AST Type Confusion	Mar 27, 2026 5mo ago
CVE-2026-4954	medium	5.3/10	mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection	Mar 27, 2026 5mo ago
CVE-2026-4953	medium	6.9/10	mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery	Mar 27, 2026 5mo ago
CVE-2026-33728	critical	9.3/10	dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution	Mar 27, 2026 5mo ago
CVE-2026-33622	medium	6.1/10	A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution	Mar 26, 2026 5mo ago