BaselineWatch
58126 CVEs · 127 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,126 New, 24 h1,521 Changed, 24 h2,448 In KEV127 Public exploit1,566 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2017-5645exploit ×2 9.8 critical 89.0% apache, netapp, log4j, oncommand_api_services, oncommand_insight In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. 8 Oct
CVE-2020-5421exploit 6.5 medium 12.0% vmware, oracle, spring_framework, commerce_guided_search, communications_brm In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. 8 Oct
CVE-2019-14540exploit 9.8 critical 11.0% fasterxml, netapp, jackson-databind, oncommand_api_services, oncommand_workflow_automation A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. 8 Oct
CVE-2020-36188exploit 8.1 high 9.0% fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. 8 Oct
CVE-2019-10219exploit ×2 6.1 medium 2.0% redhat, netapp, hibernate_validator, fuse, jboss_data_grid A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. 8 Oct
CVE-2020-25649 7.5 high 18.0% fasterxml, netapp, jackson-databind, oncommand_api_services, oncommand_workflow_automation A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. 8 Oct
CVE-2019-20330 9.8 critical 9.0% fasterxml, oracle, jackson-databind, banking_platform, communications_billing_and_revenue_management FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. 8 Oct
CVE-2018-15756 7.5 high 9.0% vmware, oracle, spring_framework, agile_product_lifecycle_management, communications_brm_-_elastic_charging_engine Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable. 8 Oct
CVE-2019-16942 9.8 critical 6.0% fasterxml, debian, jackson-databind, debian_linux, fedora A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. 8 Oct
CVE-2019-17531 9.8 critical 5.0% fasterxml, debian, jackson-databind, debian_linux, jboss_enterprise_application_platform A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. 8 Oct
CVE-2019-16335 9.8 critical 5.0% fasterxml, fedoraproject, jackson-databind, fedora, debian_linux A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540. 8 Oct
CVE-2020-36183 8.1 high 5.0% fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. 8 Oct
CVE-2020-36189 8.1 high 4.0% fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. 8 Oct
CVE-2020-36187 8.1 high 4.0% fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. 8 Oct
CVE-2020-36186 8.1 high 4.0% fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. 8 Oct
CVE-2020-36185 8.1 high 4.0% fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. 8 Oct

16 of 16

Download these 16 as CSV · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.