Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2021-3449exploit | 5.9 medium | 64.0% | openssl, debian, debian_linux, freebsd | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). | 8 Oct |
| CVE-2017-7525exploit ×5 | 9.8 critical | 38.0% | fasterxml, debian, jackson-databind, debian_linux, oncommand_balance | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. | 8 Oct |
| CVE-2021-23337exploit | 7.2 high | 21.0% | lodash, oracle, banking_corporate_lending_process_management, banking_credit_facilities_process_management | Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. | 8 Oct |
| CVE-2020-9548exploit | 9.8 critical | 19.0% | fasterxml, netapp, jackson-databind, active_iq_unified_manager, debian_linux | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). | 8 Oct |
| CVE-2019-14540exploit | 9.8 critical | 11.0% | fasterxml, netapp, jackson-databind, oncommand_api_services, oncommand_workflow_automation | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. | 8 Oct |
| CVE-2020-36188exploit | 8.1 high | 9.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. | 8 Oct |
| CVE-2019-10219exploit ×2 | 6.1 medium | 2.0% | redhat, netapp, hibernate_validator, fuse, jboss_data_grid | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. | 8 Oct |
| CVE-2021-23450 | 9.8 critical | 30.0% | linuxfoundation, oracle, dojo, communications_policy_management, primavera_unifier | All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. | 8 Oct |
| CVE-2018-14718 | 9.8 critical | 13.0% | fasterxml, debian, jackson-databind, debian_linux, banking_platform | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. | 8 Oct |
| CVE-2021-36090 | 7.5 high | 13.0% | apache, oracle, commons_compress, banking_apis, banking_digital_experience | When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. | 8 Oct |
| CVE-2018-19362 | 9.8 critical | 11.0% | fasterxml, debian, jackson-databind, debian_linux, business_process_management_suite | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. | 15 Oct |
| CVE-2018-19361 | 9.8 critical | 11.0% | fasterxml, debian, jackson-databind, debian_linux, business_process_management_suite | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization. | 15 Oct |
| CVE-2018-19360 | 9.8 critical | 11.0% | fasterxml, debian, jackson-databind, debian_linux, business_process_management_suite | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. | 15 Oct |
| CVE-2021-35517 | 7.5 high | 11.0% | apache, netapp, commons_compress, active_iq_unified_manager, oncommand_insight | When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. | 8 Oct |
| CVE-2018-14721 | 10.0 critical | 10.0% | fasterxml, debian, jackson-databind, debian_linux, banking_platform | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization. | 15 Oct |
| CVE-2018-14719 | 9.8 critical | 10.0% | fasterxml, debian, jackson-databind, debian_linux, banking_platform | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. | 8 Oct |
| CVE-2019-20330 | 9.8 critical | 9.0% | fasterxml, oracle, jackson-databind, banking_platform, communications_billing_and_revenue_management | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. | 8 Oct |
| CVE-2020-13956 | 5.3 medium | 9.0% | apache, quarkus, httpclient, data_integrator | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. | 8 Oct |
| CVE-2018-14720 | 9.8 critical | 8.0% | fasterxml, debian, jackson-databind, debian_linux, banking_platform | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. | 15 Oct |
| CVE-2017-15095 | 9.8 critical | 8.0% | fasterxml, debian, jackson-databind, debian_linux, openshift_container_platform | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. | 8 Oct |
| CVE-2019-14379 | 9.8 critical | 8.0% | fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. | 8 Oct |
| CVE-2020-11979 | 7.5 high | 8.0% | apache, gradle, ant, fedora | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process. | 8 Oct |
| CVE-2021-37714 | 7.5 high | 7.0% | jsoup, quarkus, banking_trade_finance | jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes. | 8 Oct |
| CVE-2020-28500 | 5.3 medium | 7.0% | lodash, oracle, banking_corporate_lending_process_management, banking_credit_facilities_process_management | Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. | 8 Oct |
| CVE-2019-16942 | 9.8 critical | 6.0% | fasterxml, debian, jackson-databind, debian_linux, fedora | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. | 8 Oct |
| CVE-2020-11620 | 8.1 high | 6.0% | fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). | 8 Oct |
| CVE-2020-36183 | 8.1 high | 5.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. | 8 Oct |
| CVE-2020-36189 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. | 8 Oct |
| CVE-2020-36187 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2020-36186 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. | 8 Oct |
| CVE-2020-36185 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2020-11619 | 8.1 high | 4.0% | fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). | 8 Oct |
| CVE-2020-5258 | 7.7 high | 4.0% | linuxfoundation, debian, dojo, debian_linux, communications_application_session_controller | In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2 | 8 Oct |
| CVE-2020-17521 | 5.5 medium | 1.0% | apache, netapp, groovy, snapcenter, agile_engineering_data_management | Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2. | 8 Oct |
| CVE-2026-101736 | 7.4 high | 0.00% | no CPE yet | Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). | Sat 24 Oct |
| CVE-2026-101735 | 7.1 high | 0.00% | no CPE yet | Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). | Thu 22 Oct |
| CVE-2026-101475 | 6.5 medium | 0.00% | no CPE yet | Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). | 21 Oct |
37 of 37
Download these 37 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 20:19. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.