BaselineWatch
60832 CVEs · 136 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known60,832 New, 24 h142 Changed, 24 h158 In KEV136 Public exploit1,639 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2017-5645exploit ×2 9.8 critical 89.0% apache, netapp, log4j, oncommand_api_services, oncommand_insight In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. 8 Oct
CVE-2020-8840exploit ×6 9.8 critical 27.0% fasterxml, debian, jackson-databind, debian_linux, oncommand_api_services FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. 8 Oct
CVE-2022-37434exploit ×2 9.8 critical 19.0% zlib, fedoraproject, fedora, debian_linux zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). 14 Oct
CVE-2019-14540exploit 9.8 critical 11.0% fasterxml, netapp, jackson-databind, oncommand_api_services, oncommand_workflow_automation A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. 8 Oct
CVE-2022-23852exploit 9.8 critical 5.0% libexpat_project, netapp, libexpat, clustered_data_ontap, oncommand_workflow_automation Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. 14 Oct
CVE-2021-3711 9.8 critical 88.0% openssl, debian, debian_linux, active_iq_unified_manager In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). 8 Oct
CVE-2018-8014 9.8 critical 21.0% apache, canonical, tomcat, ubuntu_linux, debian_linux The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. 15 Oct
CVE-2019-5482 9.8 critical 18.0% haxx, fedoraproject, curl, fedora, leap Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. 14 Oct
CVE-2018-14718 9.8 critical 13.0% fasterxml, debian, jackson-databind, debian_linux, banking_platform FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. 8 Oct
CVE-2018-14719 9.8 critical 10.0% fasterxml, debian, jackson-databind, debian_linux, banking_platform FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. 8 Oct
CVE-2016-9841 9.8 critical 8.0% zlib, opensuse, leap inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. 8 Oct
CVE-2019-14379 9.8 critical 8.0% fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. 8 Oct
CVE-2019-16942 9.8 critical 6.0% fasterxml, debian, jackson-databind, debian_linux, fedora A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. 8 Oct
CVE-2019-17531 9.8 critical 5.0% fasterxml, debian, jackson-databind, debian_linux, jboss_enterprise_application_platform A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. 8 Oct
CVE-2019-16335 9.8 critical 5.0% fasterxml, fedoraproject, jackson-databind, fedora, debian_linux A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540. 8 Oct

15 of 15

Download these 15 as CSV · subscribe to this list.

EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.