Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2020-9548exploit | 9.8 critical | 19.0% | fasterxml, netapp, jackson-databind, active_iq_unified_manager, debian_linux | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). | 8 Oct |
| CVE-2020-36188exploit | 8.1 high | 9.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. | 8 Oct |
| CVE-2019-10219exploit ×2 | 6.1 medium | 2.0% | redhat, netapp, hibernate_validator, fuse, jboss_data_grid | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. | 8 Oct |
| CVE-2020-25649 | 7.5 high | 18.0% | fasterxml, netapp, jackson-databind, oncommand_api_services, oncommand_workflow_automation | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. | 8 Oct |
| CVE-2020-11656 | 9.8 critical | 9.0% | sqlite, netapp, ontap_select_deploy_administration_utility, communications_network_charging_and_control | In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. | 14 Oct |
| CVE-2019-20330 | 9.8 critical | 9.0% | fasterxml, oracle, jackson-databind, banking_platform, communications_billing_and_revenue_management | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. | 8 Oct |
| CVE-2020-11620 | 8.1 high | 6.0% | fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). | 8 Oct |
| CVE-2020-36183 | 8.1 high | 5.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. | 8 Oct |
| CVE-2020-36189 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. | 8 Oct |
| CVE-2020-36187 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2020-36186 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. | 8 Oct |
| CVE-2020-36185 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2020-11619 | 8.1 high | 4.0% | fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). | 8 Oct |
| CVE-2020-13871 | 7.5 high | 4.0% | sqlite, fedoraproject, fedora, debian_linux | SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. | 14 Oct |
| CVE-2020-9327 | 7.5 high | 4.0% | sqlite, netapp, cloud_backup, ubuntu_linux | In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. | 14 Oct |
| CVE-2020-11655 | 7.5 high | 4.0% | sqlite, netapp, ontap_select_deploy_administration_utility, debian_linux | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. | 14 Oct |
| CVE-2020-13630 | 7.0 high | 1.0% | sqlite, fedoraproject, fedora, ubuntu_linux | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. | 14 Oct |
| CVE-2021-20227 | 5.5 medium | 1.0% | sqlite, oracle, communications_network_charging_and_control, enterprise_manager_for_oracle_database | A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability. | 14 Oct |
| CVE-2020-15358 | 5.5 medium | 1.0% | sqlite, canonical, ubuntu_linux, icloud | In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. | 14 Oct |
| CVE-2020-13632 | 5.5 medium | 1.0% | sqlite, fedoraproject, fedora, ubuntu_linux | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. | 14 Oct |
| CVE-2020-13631 | 5.5 medium | 1.0% | sqlite, fedoraproject, fedora, ubuntu_linux | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. | 14 Oct |
| CVE-2020-13434 | 5.5 medium | 1.0% | sqlite, debian, debian_linux, fedora | SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. | 14 Oct |
22 of 22
Download these 22 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.