BaselineWatch
59497 CVEs · 135 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known59,497 New, 24 h947 Changed, 24 h1,144 In KEV135 Public exploit1,613 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2017-7525exploit ×5 9.8 critical 38.0% fasterxml, debian, jackson-databind, debian_linux, oncommand_balance A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. 8 Oct
CVE-2020-8840exploit ×6 9.8 critical 27.0% fasterxml, debian, jackson-databind, debian_linux, oncommand_api_services FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. 8 Oct
CVE-2018-7489exploit 9.8 critical 20.0% fasterxml, debian, jackson-databind, debian_linux, communications_billing_and_revenue_management FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. 15 Oct
CVE-2020-9548exploit 9.8 critical 19.0% fasterxml, netapp, jackson-databind, active_iq_unified_manager, debian_linux FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). 8 Oct
CVE-2019-14540exploit 9.8 critical 11.0% fasterxml, netapp, jackson-databind, oncommand_api_services, oncommand_workflow_automation A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. 8 Oct
CVE-2018-14718 9.8 critical 13.0% fasterxml, debian, jackson-databind, debian_linux, banking_platform FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. 8 Oct
CVE-2018-19362 9.8 critical 11.0% fasterxml, debian, jackson-databind, debian_linux, business_process_management_suite FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. 15 Oct
CVE-2018-19361 9.8 critical 11.0% fasterxml, debian, jackson-databind, debian_linux, business_process_management_suite FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization. 15 Oct
CVE-2018-19360 9.8 critical 11.0% fasterxml, debian, jackson-databind, debian_linux, business_process_management_suite FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. 15 Oct
CVE-2018-14721 10.0 critical 10.0% fasterxml, debian, jackson-databind, debian_linux, banking_platform FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization. 15 Oct
CVE-2018-14719 9.8 critical 10.0% fasterxml, debian, jackson-databind, debian_linux, banking_platform FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. 8 Oct
CVE-2019-20330 9.8 critical 9.0% fasterxml, oracle, jackson-databind, banking_platform, communications_billing_and_revenue_management FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. 8 Oct
CVE-2018-14720 9.8 critical 8.0% fasterxml, debian, jackson-databind, debian_linux, banking_platform FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. 15 Oct
CVE-2017-15095 9.8 critical 8.0% fasterxml, debian, jackson-databind, debian_linux, openshift_container_platform A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. 8 Oct
CVE-2019-14379 9.8 critical 8.0% fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. 8 Oct
CVE-2019-16942 9.8 critical 6.0% fasterxml, debian, jackson-databind, debian_linux, fedora A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. 8 Oct
CVE-2019-14892 9.8 critical 6.0% fasterxml, redhat, jackson-databind, decision_manager, jboss_data_grid A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code. 8 Oct
CVE-2018-11307 9.8 critical 6.0% fasterxml, redhat, jackson-databind, openshift_container_platform, clusterware An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6. 8 Oct
CVE-2019-17531 9.8 critical 5.0% fasterxml, debian, jackson-databind, debian_linux, jboss_enterprise_application_platform A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. 8 Oct
CVE-2019-16335 9.8 critical 5.0% fasterxml, fedoraproject, jackson-databind, fedora, debian_linux A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540. 8 Oct
CVE-2019-14893 9.8 critical 4.0% fasterxml, netapp, jackson-databind, oncommand_api_services, steelstore_cloud_integrated_storage A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code. 8 Oct
CVE-2026-110879 9.8 critical 1.0% no CPE yet jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map<String,String> accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0. Wed 28 Oct

22 of 22

Download these 22 as CSV · subscribe to this list.

EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.