Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON…Check if you run itEPSS 0.85%Apr 10, 2026
- Medium6.9Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters…Check if you run itEPSS 1.19%Apr 10, 2026
- Medium6.9The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output.Check if you run itEPSS 0.91%Apr 10, 2026
- Medium6.9Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log inje…Check if you run itEPSS 1.19%Apr 10, 2026
- Medium6.3The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.…Check if you run itEPSS 0.50%Apr 10, 2026
- High7.5Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.Check if you run itEPSS 1.06%Apr 10, 2026
- Medium6.5CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.Check if you run itEPSS 0.45%Apr 9, 2026
- High7.5Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.Check if you run itEPSS 0.45%Apr 9, 2026
- High7.5Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.Check if you run itEPSS 0.46%Apr 9, 2026
- Medium5.3Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.Check if you run itEPSS 0.56%Apr 9, 2026
- High7.5Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.Check if you run itEPSS 2.89%Apr 9, 2026
- Critical9.1CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.Check if you run itEPSS 0.71%Apr 9, 2026
- High7.5Configured cipher preference order not preserved vulnerability in Apache Tomcat.Check if you run itEPSS 0.37%Apr 9, 2026
- Medium6.1Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.Check if you run itEPSS 0.53%Apr 9, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.Check if you run itEPSS 0.68%Apr 9, 2026
- High7.5Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.Check if you run itEPSS 0.61%Apr 9, 2026
- High8.8MISP is an open source threat intelligence and sharing platform.Check if you run itEPSS 0.66%Apr 9, 2026
- High7.5Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.Check if you run itEPSS 0.79%Apr 9, 2026
- High7.5Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.Check if you run itEPSS 0.34%Apr 9, 2026
- Medium4.3Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.Check if you run itEPSS 0.65%Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityPatch nowKEVEPSS 6.56%Apr 9, 2026
- Critical9.1When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted.Check if you run itEPSS 0.67%Apr 9, 2026
- Medium6.5Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer ro…Check if you run itEPSS 0.79%Apr 9, 2026
- High7.5An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.Check if you run itEPSS 0.52%Apr 9, 2026
- Critical9.1ChurchCRM is an open-source church management system.Check if you run itEPSS 0.92%Apr 7, 2026