CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix) Exploitation status Not known exploited Fix Not confirmed Published 09/01/2026 Severity High CVE-2026-17615Resteasy-core: resteasy sourceprovider remote unauthenticated file read Exploitation status Not known exploited Fix Not confirmed Published 08/31/2026 Severity High CVE-2026-81624Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite Exploitation status Not known exploited Fix Not confirmed Published 08/31/2026 Severity High CVE-2026-5680Undertow-core: undertow: denial of service via websocket permessage-deflate processing Exploitation status Not known exploited Fix Not confirmed Published 08/27/2026 Severity High CVE-2026-14180Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity Medium CVE-2026-15567Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity High CVE-2026-15565Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity High CVE-2026-15563Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity High CVE-2026-24330Wildfly-core: wildfly: arbitrary file read via malicious archive deployment Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity Medium CVE-2026-24329Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. Exploitation status Not known exploited Fix Not confirmed Published 08/11/2026 Severity Medium CVE-2026-50559Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities Exploitation status Public exploit Fix Not confirmed Published 06/19/2026 Severity High CVE-2026-48779ws: Memory exhaustion DoS from tiny fragments and data chunks Exploitation status Public exploit Fix Published 06/16/2026 Severity High CVE-2026-12143form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) Exploitation status Public exploit Fix Published 06/12/2026 Severity High CVE-2026-50011Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-50010Netty's wrapping plain trust manager silently disables hostname verification Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-48059Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-48043netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-48006Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-47691Netty has Insufficient Bailiwick Validation for NS Records Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-46340Netty: SCTP reassembly nests buffers without bound Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-45674Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-45416Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-44893Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length Exploitation status Not known exploited Fix Not confirmed Published 06/12/2026 Severity High CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control Exploitation status Not known exploited Fix Published 06/12/2026 Severity Critical CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator Exploitation status Not known exploited Fix Published 06/12/2026 Severity Critical CVE-2026-44890Netty has Unbounded Direct Memory Consumption in its RedisDecoder Exploitation status Not known exploited Fix Not confirmed Published 06/11/2026 Severity High CVE-2026-44250Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays Exploitation status Not known exploited Fix Not confirmed Published 06/11/2026 Severity High CVE-2026-44249Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking Exploitation status Not known exploited Fix Not confirmed Published 06/11/2026 Severity High CVE-2026-44486Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axios Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2026-44495Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2026-44492Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) Exploitation status Public exploit Fix Published 06/11/2026 Severity High CVE-2025-71319image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser Exploitation status Public exploit Fix Published 06/09/2026 Severity High CVE-2026-40984Micrometer HTTP server instrumentations DoS vulnerability Exploitation status Not known exploited Fix Published 06/09/2026 Severity High CVE-2026-40983Micrometer gRPC server instrumentation DoS vulnerability Exploitation status Not known exploited Fix Published 06/09/2026 Severity High CVE-2026-9277shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op` Exploitation status Not known exploited Fix Published 05/22/2026 Severity Critical CVE-2026-45736ws: Uninitialized memory disclosure Exploitation status Public exploit Fix Published 05/15/2026 Severity High CVE-2026-42587Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42584Netty: HttpClientCodec response desynchronization Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42579Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42578Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation Exploitation status Public exploit Fix Published 05/13/2026 Severity Low CVE-2026-42581Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization Exploitation status Public exploit Fix Published 05/13/2026 Severity High CVE-2026-42264Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking Exploitation status Public exploit Fix Published 05/08/2026 Severity High CVE-2026-41675xmldom: XML node injection through unvalidated processing instruction serialization Exploitation status Public exploit Fix Published 05/07/2026 Severity High CVE-2026-41674xmldom: XML injection through unvalidated DocumentType serialization Exploitation status Public exploit Fix Published 05/07/2026 Severity High CVE-2026-41673xmldom: Denial of service via uncontrolled recursion in XML serialization Exploitation status Public exploit Fix Published 05/07/2026 Severity High CVE-2026-41672xmldom: XML node injection through unvalidated comment serialization Exploitation status Public exploit Fix Published 05/07/2026 Severity High CVE-2026-39852Quarkus authorization bypass via semicolon path normalization inconsistency Exploitation status Not known exploited Fix Published 05/05/2026 Severity High CVE-2026-43869Apache Thrift: TSSLTransportFactory.java hostname verification Exploitation status Not known exploited Fix Published 05/05/2026 Severity High CVE-2026-40682Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor Exploitation status Not known exploited Fix Published 05/04/2026 Severity Critical CVE-2026-42027Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader Exploitation status Not known exploited Fix Published 05/04/2026 Severity Critical CVE-2026-40858Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository Exploitation status Not known exploited Fix Published 04/27/2026 Severity High CVE-2026-40860Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp Exploitation status Not known exploited Fix Published 04/27/2026 Severity Critical CVE-2026-42039Axios: unbounded recursion in toFormData causes DoS via deeply nested request data Exploitation status Public exploit Fix Published 04/24/2026 Severity Medium CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-42044Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking Exploitation status Public exploit Fix Published 04/24/2026 Severity High CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization Exploitation status Not known exploited Fix Published 04/22/2026 Severity High CVE-2026-40542Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification Exploitation status Not known exploited Fix Published 04/22/2026 Severity High CVE-2026-40895follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets Exploitation status Not known exploited Fix Published 04/21/2026 Severity Medium CVE-2026-41245Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix Exploitation status Not known exploited Fix Not confirmed Published 04/20/2026 Severity Critical CVE-2026-40478Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf Exploitation status Not known exploited Fix Published 04/17/2026 Severity Critical CVE-2026-40477Improper restriction of the scope of accessible objects in Thymeleaf expressions Exploitation status Not known exploited Fix Published 04/17/2026 Severity Critical CVE-2026-3505Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. Exploitation status Not known exploited Fix Published 04/15/2026 Severity High CVE-2026-5588PKIX draft CompositeVerifier accepts empty signature sequence as valid. Exploitation status Not known exploited Fix Published 04/15/2026 Severity Medium CVE-2026-5598Non-constant time comparisons risk private key leakage in FrodoKEM. Exploitation status Not known exploited Fix Published 04/15/2026 Severity High CVE-2026-0636LDAP Injection Vulnerability in LDAPStoreHelper.java Exploitation status Not known exploited Fix Published 04/15/2026 Severity Medium CVE-2025-14813GOSTCTR implementation unable to process more than 255 blocks correctly Exploitation status Not known exploited Fix Published 04/15/2026 Severity Critical CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Exploitation status Public exploit Fix Published 04/14/2026 Severity High CVE-2026-40175Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Exploitation status Public exploit Fix Published 04/10/2026 Severity High CVE-2025-62718Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Exploitation status Public exploit Fix Published 04/09/2026 Severity Medium CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans Exploitation status KEV Fix Published 04/07/2026 Severity High CVE-2026-4800lodash vulnerable to Code Injection via `_.template` imports key names Exploitation status Not known exploited Fix Published 03/31/2026 Severity High CVE-2026-33896Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33895Forge has signature forgery in Ed25519 due to missing S > L check Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33894Forge has signature forgery in RSA-PKCS due to ASN.1 extra field Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33891Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33871Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-33870Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Exploitation status Public exploit Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing Exploitation status Not known exploited Fix Not confirmed Published 03/27/2026 Severity High CVE-2026-4926path-to-regexp vulnerable to Denial of Service via sequential optional groups Exploitation status Not known exploited Fix Published 03/26/2026 Severity High CVE-2025-67030CVE-2025-67030 Exploitation status Not known exploited Fix Not confirmed Published 03/25/2026 Severity High CVE-2026-3260CVE-2026-3260 Exploitation status Not confirmed Fix Not confirmed Published 03/24/2026 Severity Unknown CVE-2026-33228flatted: Prototype Pollution via parse() Exploitation status Public exploit Fix Published 03/20/2026 Severity High CVE-2025-57849Fuse: privilege escalation via excessive /etc/passwd permissions Exploitation status Not known exploited Fix Not confirmed Published 03/13/2026 Severity Medium CVE-2026-32141flatted: Unbounded recursion DoS in parse() revive phase Exploitation status Public exploit Fix Published 03/12/2026 Severity High CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpath Exploitation status Public exploit Fix Published 03/07/2026 Severity High CVE-2026-29074SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) Exploitation status Not known exploited Fix Published 03/06/2026 Severity High CVE-2026-1605CVE-2026-1605 Exploitation status Not known exploited Fix Published 03/05/2026 Severity High CVE-2026-27446Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Exploitation status Not known exploited Fix Published 03/04/2026 Severity Critical CVE-2026-27830c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property Exploitation status Not known exploited Fix Not confirmed Published 02/26/2026 Severity High CVE-2026-27727mchange-commons-java: Remote Code Execution via JNDI Reference Resolution Exploitation status Public exploit Fix Not confirmed Published 02/25/2026 Severity High CVE-2026-27606Rollup 4 has Arbitrary File Write via Path Traversal Exploitation status Public exploit Fix Not confirmed Published 02/25/2026 Severity High CVE-2026-25747Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB Exploitation status Public exploit Fix Published 02/23/2026 Severity High 
