Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2018-1270exploit ×4 | 9.8 critical | 77.0% | vmware, oracle, spring_framework, application_testing_suite, big_data_discovery | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. | 8 Oct |
| CVE-2019-10086 | 7.3 high | 29.0% | apache, debian, commons_beanutils, nifi, debian_linux | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. | 8 Oct |
| CVE-2020-10543 | 8.2 high | 11.0% | perl, fedoraproject, fedora, leap | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. | 14 Oct |
| CVE-2020-12723 | 7.5 high | 6.0% | perl, netapp, oncommand_workflow_automation, snap_creator_framework | regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. | 14 Oct |
| CVE-2020-10878 | 8.6 high | 5.0% | perl, fedoraproject, fedora, leap | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. | 14 Oct |
| CVE-2018-1257 | 6.5 medium | 3.0% | vmware, redhat, spring_framework, openshift, agile_product_lifecycle_management | Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. | 8 Oct |
| CVE-2018-11039 | 5.9 medium | 3.0% | vmware, oracle, spring_framework, agile_product_lifecycle_management, application_testing_suite | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack. | 8 Oct |
7 of 7
Download these 7 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.