Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the…Check if you run itEPSS 0.82%Apr 27, 2026
- Critical9.8JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via java…Check if you run itEPSS 1.53%Apr 27, 2026
- High8.8The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter…Check if you run itEPSS 1.15%Apr 27, 2026
- Critical9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out…Check if you run itEPSS 1.89%Apr 27, 2026
- High7.8The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of files in the configured key directory using java.io.ObjectInputStream without applying an…Check if you run itEPSS 0.46%Apr 27, 2026
- Critical9.3BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credenti…Check if you run itEPSS 1.05%Apr 24, 2026
- Medium4.3The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for an…Check if you run itEPSS 0.57%Apr 24, 2026
- Medium4.3The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with…Check if you run itEPSS 0.57%Apr 24, 2026
- High8.1Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the pl…Check if you run itEPSS 0.45%Apr 24, 2026
- High8.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.Check if you run itEPSS 1.15%Apr 24, 2026
- Medium6.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.Check if you run itEPSS 0.72%Apr 24, 2026
- High8.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.Patch nowKEVEPSS 4.11%Apr 24, 2026
- Medium6.3Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.Check if you run itEPSS 0.54%Apr 24, 2026
- High7.4Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Check if you run itEPSS 0.91%Apr 24, 2026
- High8.9Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Check if you run itEPSS 0.52%Apr 24, 2026
- High7.7Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Check if you run itEPSS 0.54%Apr 24, 2026
- High8.9Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Check if you run itEPSS 1.03%Apr 24, 2026
- High7.2The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2.Check if you run itEPSS 1.55%Apr 22, 2026
- Medium5.5The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2.Check if you run itEPSS 0.56%Apr 22, 2026
- High7.3Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual au…Check if you run itEPSS 0.70%Apr 22, 2026
- UnknownApache ActiveMQ Initialization of a Resource with an Insecure DefaultPatch nowKEVEPSS 7.15%Apr 22, 2026
- High7.7Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Check if you run itEPSS 0.56%Apr 20, 2026
- Medium5.7Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Check if you run itEPSS 0.49%Apr 20, 2026
- Critical9.2Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler all…Check if you run itEPSS 0.91%Apr 20, 2026
- Medium5.3Information exposure vulnerability has been identified in Apache Kafka.Check if you run itEPSS 0.89%Apr 20, 2026