# cve.now: Maven packages

The newest entries affecting Maven packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [CVE-2026-123765](https://cve.now/CVE-2026-123765.md): Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls. (low (no CVSS), Apache Software Foundation org.apache.sling:org.apache.slin…)
- [CVE-2026-89326](https://cve.now/CVE-2026-89326.md): Apache XML Graphics Batik: Check url protocol when loading document (no CVSS, Apache Software Foundation org.apache.xmlgraphics:batik-bri…)
- [CVE-2026-71395](https://cve.now/CVE-2026-71395.md): Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading (no CVSS, Apache Software Foundation org.apache.xmlgraphics:fop-core)
- [CVE-2026-44929](https://cve.now/CVE-2026-44929.md): SSRF Vulnerability in Apache Batik (no CVSS, Apache Software Foundation org.apache.xmlgraphics:batik-util)
- [CVE-2026-49236](https://cve.now/CVE-2026-49236.md): Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks (no CVSS, Apache Software Foundation org.apache.xmlgraphics:batik-bri…)
- [CVE-2026-40853](https://cve.now/CVE-2026-40853.md): Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont (no CVSS, Apache Software Foundation org.apache.xmlgraphics:batik-svg…)
- [CVE-2026-124496](https://cve.now/CVE-2026-124496.md): Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer (low (no CVSS), Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-124495](https://cve.now/CVE-2026-124495.md): Apache Storm: Logviewer follows worker symlinks across topology ACLs (low (no CVSS), Apache Software Foundation org.apache.storm:storm-webapp)
- [CVE-2026-94125](https://cve.now/CVE-2026-94125.md): Apache Storm: Supervisor page discloses worker placement of other users' topologies (low (no CVSS), Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-122096](https://cve.now/CVE-2026-122096.md): Apache DataSketches Java denial of service in sketch deserialization (low (no CVSS), Apache Software Foundation org.apache.datasketches:datasket…)
- [CVE-2026-126627](https://cve.now/CVE-2026-126627.md): Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users (low (no CVSS), Apache Software Foundation org.apache.xmlgraphics:fop-core)
- [CVE-2026-111792](https://cve.now/CVE-2026-111792.md): Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution (no CVSS, Apache Software Foundation org.apache.xmlgraphics:batik-bri…)
- [CVE-2026-90993](https://cve.now/CVE-2026-90993.md): Apache XML Graphics Batik: Harden validation in SAXDocumentFactory (no CVSS, Apache Software Foundation org.apache.xmlgraphics:batik-dom)
- [CVE-2026-86336](https://cve.now/CVE-2026-86336.md): Apache TomEE: EJB method authorization is silently skipped on JDK 21+ (no CVSS, Apache Software Foundation org.apache.tomee:openejb-core)
- [CVE-2026-86531](https://cve.now/CVE-2026-86531.md): Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server (no CVSS, Apache Software Foundation org.apache.openejb:openejb-http…)
- [CVE-2026-87758](https://cve.now/CVE-2026-87758.md): Apache TomEE: Missing TLS hostname verification in ejbds client connections (no CVSS, Apache Software Foundation org.apache.openejb:openejb-clien…)
- [CVE-2026-97849](https://cve.now/CVE-2026-97849.md): Apache TomEE: Derby network service listens on all interfaces (no CVSS, Apache Software Foundation org.apache.openejb:openejb-derby…)
- [CVE-2026-97867](https://cve.now/CVE-2026-97867.md): Apache TomEE: Database credential disclosure via remote JNDI lookup (no CVSS, Apache Software Foundation org.apache.openejb:openejb-ejbd…)
- [CVE-2026-97870](https://cve.now/CVE-2026-97870.md): Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server (no CVSS, Apache Software Foundation org.apache.openejb:openejb-hessi…)
- [CVE-2026-97872](https://cve.now/CVE-2026-97872.md): Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings (no CVSS, Apache Software Foundation org.apache.openejb:openejb-hessi…)
- [CVE-2026-97874](https://cve.now/CVE-2026-97874.md): Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications (no CVSS, Apache Software Foundation org.apache.openejb:openejb-hessi…)
- [CVE-2026-97880](https://cve.now/CVE-2026-97880.md): Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication (no CVSS, Apache Software Foundation org.apache.openejb:openejb-http…)
- [CVE-2026-97881](https://cve.now/CVE-2026-97881.md): Apache TomEE: Path traversal in embedded HTTP server static resource handling (no CVSS, Apache Software Foundation org.apache.tomee:openejb-http)
- [CVE-2026-97888](https://cve.now/CVE-2026-97888.md): Apache TomEE: Caller identity leaks across requests in embedded HTTP server (no CVSS, Apache Software Foundation org.apache.tomee:openejb-http)
- [CVE-2026-97890](https://cve.now/CVE-2026-97890.md): Apache TomEE: Session fixation in embedded HTTP server (low (no CVSS), Apache Software Foundation org.apache.tomee:openejb-http)
- [CVE-2026-111239](https://cve.now/CVE-2026-111239.md): Apache TomEE: Code execution by any authenticated user via the SSH administration shell (no CVSS, Apache Software Foundation org.apache.openejb:openejb-ss… +2)
- [CVE-2026-111240](https://cve.now/CVE-2026-111240.md): Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module (no CVSS, Apache Software Foundation org.apache.openejb:openejb-core…)
- [CVE-2026-111241](https://cve.now/CVE-2026-111241.md): Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory (no CVSS, Apache Software Foundation org.apache.openejb:openejb-core…)
- [CVE-2026-111242](https://cve.now/CVE-2026-111242.md): Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity (no CVSS, Apache Software Foundation org.apache.tomee:mp-jwt)
- [CVE-2026-111243](https://cve.now/CVE-2026-111243.md): Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew (low (no CVSS), Apache Software Foundation org.apache.tomee:mp-jwt)
- [CVE-2026-111244](https://cve.now/CVE-2026-111244.md): Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources (no CVSS, Apache Software Foundation org.apache.tomee:mp-jwt)
- [CVE-2026-111245](https://cve.now/CVE-2026-111245.md): Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests (no CVSS, Apache Software Foundation org.apache.openejb:openejb-cxf ·…)
- [CVE-2026-111246](https://cve.now/CVE-2026-111246.md): Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server (low (no CVSS), Apache Software Foundation org.apache.openejb:openejb-http…)
- [CVE-2026-111247](https://cve.now/CVE-2026-111247.md): Apache TomEE: Privilege escalation via user name matching a role name (no CVSS, Apache Software Foundation org.apache.tomee:tomee-catalina)
- [CVE-2026-111248](https://cve.now/CVE-2026-111248.md): Apache TomEE: Authentication with the stored password digest in Tomcat user identity store (low (no CVSS), Apache Software Foundation org.apache.tomee:tomee-security)
- [CVE-2026-111249](https://cve.now/CVE-2026-111249.md): Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network (low (no CVSS), Apache Software Foundation org.apache.tomee:livereload-tomee)
- [CVE-2026-111250](https://cve.now/CVE-2026-111250.md): Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server (no CVSS, Apache Software Foundation org.apache.openejb:openejb-http…)
- [CVE-2026-111251](https://cve.now/CVE-2026-111251.md): Apache TomEE: Unauthenticated server shutdown via the admin port (no CVSS, Apache Software Foundation org.apache.openejb:openejb-serve…)
- [CVE-2026-111256](https://cve.now/CVE-2026-111256.md): Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server (no CVSS, Apache Software Foundation org.apache.openejb:openejb-we… +2)
- [CVE-2026-111257](https://cve.now/CVE-2026-111257.md): Apache TomEE: Well-known administrative credentials created at startup (no CVSS, Apache Software Foundation org.apache.openejb:tomee-catalin…)
- [CVE-2026-111258](https://cve.now/CVE-2026-111258.md): Apache TomEE: Security constraint bypass via request routing (no CVSS, Apache Software Foundation org.apache.openejb:tomee-catalin…)
- [CVE-2026-111259](https://cve.now/CVE-2026-111259.md): Apache TomEE: Predictable HTTP session identifiers in embedded server (no CVSS, Apache Software Foundation org.apache.tomee:tomee-embedded)
- [CVE-2026-111260](https://cve.now/CVE-2026-111260.md): Apache TomEE: Predictable OpenID Connect state and nonce values (low (no CVSS), Apache Software Foundation org.apache.tomee:tomee-security)
- [CVE-2026-111261](https://cve.now/CVE-2026-111261.md): Apache TomEE: Authentication bypass with empty password in LDAP identity store (no CVSS, Apache Software Foundation org.apache.tomee:tomee-security)
- [CVE-2026-111262](https://cve.now/CVE-2026-111262.md): Apache TomEE: LDAP injection in LDAP identity store (no CVSS, Apache Software Foundation org.apache.tomee:tomee-security)
- [CVE-2026-111263](https://cve.now/CVE-2026-111263.md): Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application (no CVSS, Apache Software Foundation org.apache.openejb:tomee-webserv…)
- [CVE-2026-111264](https://cve.now/CVE-2026-111264.md): Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method (no CVSS, Apache Software Foundation org.apache.openejb:tomee-webserv…)
- [CVE-2026-87756](https://cve.now/CVE-2026-87756.md): Apache TomEE: Missing authorization on internal deployer EJBs in default profile (no CVSS, Apache Software Foundation org.apache.openejb:openejb-core…)
- [CVE-2026-87755](https://cve.now/CVE-2026-87755.md): Apache TomEE: Stateful session bean hijacking via predictable session identifiers (no CVSS, Apache Software Foundation org.apache.openejb:openejb-core…)
- [CVE-2026-86811](https://cve.now/CVE-2026-86811.md): Apache TomEE: Path traversal via stateful EJB passivation (no CVSS, Apache Software Foundation org.apache.openejb:openejb-core…)
- [CVE-2026-86532](https://cve.now/CVE-2026-86532.md): Apache TomEE: Username enumeration and timing side channel in JAAS login modules (low (no CVSS), Apache Software Foundation org.apache.openejb:openejb-core…)
- [CVE-2026-120350](https://cve.now/CVE-2026-120350.md): Stored XSS in rich text editor via video embed (CVSS 5.1, com.vaadin:vaadin · com.vaadin:vaadin-core +3)
- [CVE-2026-120326](https://cve.now/CVE-2026-120326.md): Vaadin download file name injection in Content-Disposition header (CVSS 4.8, com.vaadin:vaadin · com.vaadin:vaadin-core +1)
- [CVE-2026-119078](https://cve.now/CVE-2026-119078.md): Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys (CVSS 9.1, Apache Software Foundation commons-codec:commons-codec)
- [CVE-2026-124077](https://cve.now/CVE-2026-124077.md): Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class) (CVSS 4.3, Apache Software Foundation commons-codec:commons-codec · Ap…)
- [CVE-2026-120367](https://cve.now/CVE-2026-120367.md): Apache Axis2/Java: unbounded JSON request body buffering (CVSS 7.5, Apache Software Foundation org.apache.axis2:axis2-json)
- [CVE-2026-123779](https://cve.now/CVE-2026-123779.md): Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes (CVSS 5.3, Apache Software Foundation org.apache.axis2:axis2-transport…)
- [CVE-2026-123753](https://cve.now/CVE-2026-123753.md): Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints (CVSS 9.1, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-123766](https://cve.now/CVE-2026-123766.md): Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page (CVSS 6.1, Apache Software Foundation org.apache.axis2:axis2-openapi)
- [CVE-2026-123770](https://cve.now/CVE-2026-123770.md): Apache Axis2/Java: Unbounded multipart and form-encoded request bodies (CVSS 7.5, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-120761](https://cve.now/CVE-2026-120761.md): Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents (CVSS 9.1, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-120832](https://cve.now/CVE-2026-120832.md): Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution (CVSS 6.5, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-82436](https://cve.now/CVE-2026-82436.md): Apache Storm Client: Deserialization of Untrusted Data from the State Store (CVSS 8.8, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-82440](https://cve.now/CVE-2026-82440.md): Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist (CVSS 8.1, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-59171](https://cve.now/CVE-2026-59171.md): JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS (CVSS 5.9, stleary JSON-java · org.json:json)
- [CVE-2026-75598](https://cve.now/CVE-2026-75598.md): Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization (CVSS 6.3, GradleUp shadow · com.gradleup.shadow:com.gradleup.shadow.g…)
- [CVE-2026-90436](https://cve.now/CVE-2026-90436.md): Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName (CVSS 9.8, Apache Software Foundation axis:axis · Apache Software F… +1)
- [CVE-2026-85111](https://cve.now/CVE-2026-85111.md): Apache James: Denial of service upon MIME parsing (CVSS 8.7, Apache Software Foundation Apache James · Apache Software F…)
- [CVE-2026-85108](https://cve.now/CVE-2026-85108.md): Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling (CVSS 7.5, Apache Software Foundation org.apache.james:apache-mime4j-c…)
- [CVE-2026-54442](https://cve.now/CVE-2026-54442.md): NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF (CVSS 4.8, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-121489](https://cve.now/CVE-2026-121489.md): Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-microse…)
- [CVE-2026-96677](https://cve.now/CVE-2026-96677.md): Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-marshall)
- [CVE-2026-73117](https://cve.now/CVE-2026-73117.md): Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73116](https://cve.now/CVE-2026-73116.md): Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-cl…)
- [CVE-2026-73101](https://cve.now/CVE-2026-73101.md): Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73100](https://cve.now/CVE-2026-73100.md): Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73099](https://cve.now/CVE-2026-73099.md): Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73098](https://cve.now/CVE-2026-73098.md): Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-marshall)
- [CVE-2026-73095](https://cve.now/CVE-2026-73095.md): Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling (CVSS 8.7, Apache Software Foundation org.apache.juneau:juneau-marshal…)
- [CVE-2026-112072](https://cve.now/CVE-2026-112072.md): vault-java-driver: stored deeply nested JSON kills every thread that reads it (CVSS 6.5, io.github.jopenlibs:vault-java-driver)
- [CVE-2026-109408](https://cve.now/CVE-2026-109408.md): vault-java-driver: SslConfig silently disables requested TLS verification (CVSS 7.4, io.github.jopenlibs:vault-java-driver)
- [CVE-2026-106554](https://cve.now/CVE-2026-106554.md): jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC) (CVSS 7.5, com.fasterxml.jackson.dataformat:jackson-dataformat-cbor ·…)
- [CVE-2026-114456](https://cve.now/CVE-2026-114456.md): Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers (CVSS 6.5, snowflake-connector-python · github.com/snowflakedb/gosn… +9)
- [CVE-2026-100302](https://cve.now/CVE-2026-100302.md): Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling (CVSS 7.1, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-115448](https://cve.now/CVE-2026-115448.md): Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable (CVSS 8.7, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-100300](https://cve.now/CVE-2026-100300.md): Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply… (CVSS 8.7, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-100252](https://cve.now/CVE-2026-100252.md): Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID (CVSS 8.6, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-100235](https://cve.now/CVE-2026-100235.md): Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation (CVSS 6.0, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-108946](https://cve.now/CVE-2026-108946.md): Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection (CVSS 6.5, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-111822](https://cve.now/CVE-2026-111822.md): Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation (CVSS 8.1, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-111821](https://cve.now/CVE-2026-111821.md): Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal (CVSS 7.5, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-108949](https://cve.now/CVE-2026-108949.md): Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM (CVSS 6.5, Apache Software Foundation org.apache.activemq:activemq-bro…)
- [CVE-2026-39379](https://cve.now/CVE-2026-39379.md): GeoNetwork: Reflected XSS through client-side template injection (CVSS 7.1, core-geonetwork · org.geonetwork-opensource:geonetwork)
- [CVE-2026-46487](https://cve.now/CVE-2026-46487.md): GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field (CVSS 7.5, core-geonetwork · org.geonetwork-opensource:geonetwork)
- [CVE-2026-63499](https://cve.now/CVE-2026-63499.md): zt-zip: ZipUtil.unpack can change file permissions of output directory (CVSS 6.9, zeroturnaround zt-zip · org.zeroturnaround:zt-zip)
- [CVE-2026-63436](https://cve.now/CVE-2026-63436.md): zt-zip: Path traversal in fluent API unpack (CVSS 6.1, zeroturnaround zt-zip · org.zeroturnaround:zt-zip)
- [CVE-2026-119641](https://cve.now/CVE-2026-119641.md): Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership (CVSS 6.5, Apache Software Foundation org.apache.oozie:oozie-main)
- [CVE-2026-119724](https://cve.now/CVE-2026-119724.md): Apache JClouds: XML External Entity (XXE) in provider-response parsing (CVSS 7.5, Apache Software Foundation org.apache.jclouds:jclouds-core)
- [CVE-2026-114364](https://cve.now/CVE-2026-114364.md): Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-113687](https://cve.now/CVE-2026-113687.md): Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-113511](https://cve.now/CVE-2026-113511.md): Apache Syncope: Delegated administration boundaries can be bypassed for Realm update (CVSS 9.1, Apache Software Foundation org.apache.syncope.core.idrepo:s…)
- [CVE-2026-110535](https://cve.now/CVE-2026-110535.md): Apache Syncope: AuthProfile value escalation via self-service update (CVSS 8.8, Apache Software Foundation org.apache.syncope.core.am:synco…)
- [CVE-2026-109083](https://cve.now/CVE-2026-109083.md): Apache Syncope: Remote Code Execution via Flowable JUEL expression (CVSS 9.8, Apache Software Foundation org.apache.syncope.ext.flowable:…)
- [CVE-2026-111089](https://cve.now/CVE-2026-111089.md): Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup (CVSS 7.6, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-95863](https://cve.now/CVE-2026-95863.md): Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup (CVSS 7.6, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-87718](https://cve.now/CVE-2026-87718.md): Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates (CVSS 2.3, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-84231](https://cve.now/CVE-2026-84231.md): Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag (CVSS 7.4, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-84177](https://cve.now/CVE-2026-84177.md): Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore (CVSS 6.3, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-84172](https://cve.now/CVE-2026-84172.md): Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader (CVSS 6.3, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-84170](https://cve.now/CVE-2026-84170.md): Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource (CVSS 8.3, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-83594](https://cve.now/CVE-2026-83594.md): Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names (CVSS 8.3, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-83559](https://cve.now/CVE-2026-83559.md): Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal (CVSS 7.4, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-83539](https://cve.now/CVE-2026-83539.md): Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data (CVSS 7.4, Apache Software Foundation org.apache.wicket:wicket-extensi…)
- [CVE-2026-82956](https://cve.now/CVE-2026-82956.md): Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name (CVSS 7.6, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-82898](https://cve.now/CVE-2026-82898.md): Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in (CVSS 2.1, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-82840](https://cve.now/CVE-2026-82840.md): Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication (CVSS 7.2, Apache Software Foundation org.apache.wicket:wicket-auth-ro…)
- [CVE-2026-82705](https://cve.now/CVE-2026-82705.md): Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component (CVSS 6.3, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-82704](https://cve.now/CVE-2026-82704.md): Apache Wicket: A listener is invoked on a page instance the request itself created and never configured (CVSS 6.9, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-82559](https://cve.now/CVE-2026-82559.md): Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation (CVSS 2.3, Apache Software Foundation org.apache.wicket:wicket-native-…)
- [CVE-2026-82558](https://cve.now/CVE-2026-82558.md): Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke (CVSS 2.3, Apache Software Foundation org.apache.wicket:wicket-native-…)
- [CVE-2026-82557](https://cve.now/CVE-2026-82557.md): Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission (CVSS 6.9, Apache Software Foundation org.apache.wicket:wicket-core)
- [CVE-2026-82115](https://cve.now/CVE-2026-82115.md): Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource (CVSS 6.3, Apache Software Foundation org.apache.wicket:wicket-native-…)
- [CVE-2026-120135](https://cve.now/CVE-2026-120135.md): Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default (CVSS 8.2, Apache Software Foundation org.apache.thrift:libthrift)
- [CVE-2026-118636](https://cve.now/CVE-2026-118636.md): Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (CVSS 9.8, Apache Software Foundation org.apache.mina:mina-core)
- [CVE-2026-63224](https://cve.now/CVE-2026-63224.md): OpenRemote has authenticated SQL injection in crosstab datapoint exports (CVSS 7.2, openremote · io.openremote:openremote-manager)
- [CVE-2026-61586](https://cve.now/CVE-2026-61586.md): Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider) (CVSS 8.2, copernik-eu copernik-xml-factory · eu.copernik:copernik-xml…)
- [CVE-2026-119280](https://cve.now/CVE-2026-119280.md): MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths (CVSS 3.7, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-119279](https://cve.now/CVE-2026-119279.md): MariaDB Connector/J: Length-encoded integers larger than Integer.MAX\_VALUE were truncated before being used as lengths (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-119276](https://cve.now/CVE-2026-119276.md): MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-114349](https://cve.now/CVE-2026-114349.md): Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches (CVSS 6.5, Apache Software Foundation org.apache.kafka:kafka\_2.11 ·… +1)
- [CVE-2026-112375](https://cve.now/CVE-2026-112375.md): Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs (CVSS 6.5, Apache Software Foundation org.apache.kafka:kafka)
- [CVE-2026-116593](https://cve.now/CVE-2026-116593.md): Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint (CVSS 8.1, Apache Software Foundation org.apache.kafka:connect-runtime)
- [CVE-2026-115644](https://cve.now/CVE-2026-115644.md): Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions (CVSS 8.8, Apache Software Foundation org.apache.kafka:connect-runtime)
- [CVE-2026-111551](https://cve.now/CVE-2026-111551.md): Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation (CVSS 7.5, Apache Software Foundation org.apache.kafka:kafka-streams ·…)
- [CVE-2026-111496](https://cve.now/CVE-2026-111496.md): Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation (CVSS 9.1, Apache Software Foundation org.apache.kafka:kafka-streams)
- [CVE-2026-111115](https://cve.now/CVE-2026-111115.md): Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing (CVSS 9.1, Apache Software Foundation org.apache.kafka:kafka)
- [CVE-2026-111108](https://cve.now/CVE-2026-111108.md): Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers (CVSS 9.1, Apache Software Foundation org.apache.kafka:kafka)
- [CVE-2026-111073](https://cve.now/CVE-2026-111073.md): Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of… (CVSS 6.5, Apache Software Foundation org.apache.kafka:kafka)
- [CVE-2026-110985](https://cve.now/CVE-2026-110985.md): Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured (CVSS 9.1, Apache Software Foundation org.apache.kafka:kafka)
- [CVE-2026-110952](https://cve.now/CVE-2026-110952.md): Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default (CVSS 5.9, Apache Software Foundation org.apache.kafka:kafka)
- [CVE-2026-83525](https://cve.now/CVE-2026-83525.md): Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller… (CVSS 6.5, Apache Software Foundation org.apache.kafka:kafka-raft)
- [CVE-2026-110879](https://cve.now/CVE-2026-110879.md): jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation… (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind · FasterXML too…)
- [CVE-2026-110747](https://cve.now/CVE-2026-110747.md): jackson-dataformat-protobuf: integer overflow in ProtobufParser.\_readStringKey() allows OutOfMemoryError from an 8-byte payload (CVSS 7.5, com.fasterxml.jackson.dataformat:jackson-dataformat-protobu…)
- [CVE-2026-104895](https://cve.now/CVE-2026-104895.md): jackson-dataformat-smile: unbounded eager byte\[\] allocation for raw binary in the async parser allows OutOfMemoryError denial of service (CVSS 7.5, com.fasterxml.jackson.dataformat:jackson-dataformat-smile ·…)
- [CVE-2026-104016](https://cve.now/CVE-2026-104016.md): jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError (CVSS 7.5, com.fasterxml.jackson.dataformat:jackson-dataformat-protobu…)
- [CVE-2026-110737](https://cve.now/CVE-2026-110737.md): Push Endpoint Returns Permissive CORS Headers (CVSS 2.3, com.vaadin:vaadin · com.vaadin:vaadin-core +3)
- [CVE-2026-110748](https://cve.now/CVE-2026-110748.md): Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files (CVSS 5.5, Apache Software Foundation org.apache.sis:sis-metadata)
- [CVE-2026-95628](https://cve.now/CVE-2026-95628.md): Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) (CVSS 5.4, Apache Software Foundation org.apache.camel:camel-docling)
- [CVE-2026-95629](https://cve.now/CVE-2026-95629.md): Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory (CVSS 5.4, Apache Software Foundation org.apache.camel:camel-docling)
- [CVE-2026-95663](https://cve.now/CVE-2026-95663.md): Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by… (CVSS 4.8, Apache Software Foundation org.apache.camel:camel-keycloak)
- [CVE-2026-101259](https://cve.now/CVE-2026-101259.md): Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-coap)
- [CVE-2026-88900](https://cve.now/CVE-2026-88900.md): Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution (CVSS 8.8, Apache Software Foundation org.apache.camel:camel-jgroups)
- [CVE-2026-85317](https://cve.now/CVE-2026-85317.md): Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache (CVSS 4.8, Apache Software Foundation org.apache.camel:camel-http)
- [CVE-2026-85316](https://cve.now/CVE-2026-85316.md): Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching (CVSS 4.8, Apache Software Foundation org.apache.camel:camel-platform-…)
- [CVE-2026-85315](https://cve.now/CVE-2026-85315.md): Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-grpc)
- [CVE-2026-85314](https://cve.now/CVE-2026-85314.md): Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of… (CVSS 6.5, Apache Software Foundation org.apache.camel:camel-mail)
- [CVE-2026-85313](https://cve.now/CVE-2026-85313.md): Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set (CVSS 4.3, Apache Software Foundation org.apache.camel:camel-jetty)
- [CVE-2026-85312](https://cve.now/CVE-2026-85312.md): Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header (CVSS 4.8, Apache Software Foundation org.apache.camel:camel-core)
- [CVE-2026-85296](https://cve.now/CVE-2026-85296.md): Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State (CVSS 6.5, Apache Software Foundation org.apache.camel:camel-as2)
- [CVE-2026-85260](https://cve.now/CVE-2026-85260.md): Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default (CVSS 5.5, Apache Software Foundation org.apache.camel:camel-mllp)
- [CVE-2026-85257](https://cve.now/CVE-2026-85257.md): Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-cxf)
- [CVE-2026-85254](https://cve.now/CVE-2026-85254.md): Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing (CVSS 6.5, Apache Software Foundation org.apache.camel:camel-platform-…)
- [CVE-2026-85251](https://cve.now/CVE-2026-85251.md): Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-http)
- [CVE-2026-85250](https://cve.now/CVE-2026-85250.md): Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-xpath)
- [CVE-2026-85249](https://cve.now/CVE-2026-85249.md): Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata (CVSS 6.5, Apache Software Foundation org.apache.camel:camel-tika)
- [CVE-2026-85247](https://cve.now/CVE-2026-85247.md): Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore (CVSS 5.9, Apache Software Foundation org.apache.camel:camel-knative)
- [CVE-2026-85246](https://cve.now/CVE-2026-85246.md): Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-mina)
- [CVE-2026-85245](https://cve.now/CVE-2026-85245.md): Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target (CVSS 5.9, Apache Software Foundation org.apache.camel:camel-thrift)
- [CVE-2026-85243](https://cve.now/CVE-2026-85243.md): Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure (CVSS 5.9, Apache Software Foundation org.apache.camel:camel-crypto-pgp)
- [CVE-2026-84181](https://cve.now/CVE-2026-84181.md): Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse (CVSS 5.9, Apache Software Foundation org.apache.camel:camel-shiro)
- [CVE-2026-84180](https://cve.now/CVE-2026-84180.md): Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-knative)
- [CVE-2026-84176](https://cve.now/CVE-2026-84176.md): Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection (CVSS 6.5, Apache Software Foundation org.apache.camel:camel-platform-…)
- [CVE-2026-80344](https://cve.now/CVE-2026-80344.md): Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address (CVSS 8.2, Apache Software Foundation org.apache.camel:camel-as2)
- [CVE-2026-80343](https://cve.now/CVE-2026-80343.md): Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching (CVSS 8.2, Apache Software Foundation org.apache.camel:camel-netty-http)
- [CVE-2026-79986](https://cve.now/CVE-2026-79986.md): Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without… (CVSS 7.4, Apache Software Foundation org.apache.camel:camel-azure-fil…)
- [CVE-2026-79983](https://cve.now/CVE-2026-79983.md): Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without… (CVSS 7.4, Apache Software Foundation org.apache.camel:camel-ftp)
- [CVE-2026-78162](https://cve.now/CVE-2026-78162.md): Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) (CVSS 10.0, Apache Software Foundation org.apache.camel:camel-hazelcast)
- [CVE-2026-92414](https://cve.now/CVE-2026-92414.md): Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (CVSS 9.3, Apache Software Foundation org.apache.jackrabbit:jackrabbit…)
- [CVE-2026-106451](https://cve.now/CVE-2026-106451.md): yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user (CVSS 7.3, yawkat lz4-java · at.yawk.lz4:lz4-java +1)
- [CVE-2026-104711](https://cve.now/CVE-2026-104711.md): Apache Struts: OGNL injection in the legacy RESTful action mapper (CVSS 9.8, Apache Software Foundation org.apache.struts:struts2-core)
- [CVE-2026-92899](https://cve.now/CVE-2026-92899.md): Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce (CVSS 4.8, Apache Software Foundation org.apache.wss4j:wss4j-ws-securi…)
- [CVE-2026-16454](https://cve.now/CVE-2026-16454.md): Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration (CVSS 4.3, Eclipse Foundation eclipse-hawkbit/hawkbit · org.eclipse.ha…)
- [CVE-2026-55957](https://cve.now/CVE-2026-55957.md): Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind (CVSS 7.3, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-55956](https://cve.now/CVE-2026-55956.md): Apache Tomcat: Security constraints for default servlet ignored method (CVSS 6.5, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-55955](https://cve.now/CVE-2026-55955.md): Apache Tomcat: EncryptInterceptor not protected against replay attacks (CVSS 6.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2026-55276](https://cve.now/CVE-2026-55276.md): Apache Tomcat: Logged effective web.xml is incomplete (CVSS 9.1, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-53404](https://cve.now/CVE-2026-53404.md): Apache Tomcat: Bad ornext processing in RewriteValve (CVSS 7.3, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-50229](https://cve.now/CVE-2026-50229.md): Apache Tomcat: XSS in number guess example (CVSS 6.1, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2025-64152](https://cve.now/CVE-2025-64152.md): Apache IoTDB: Path Traversal Vulnerability (CVSS 9.1, Apache Software Foundation Apache IoTDB · org.apache.iotdb:…)
- [CVE-2025-55017](https://cve.now/CVE-2025-55017.md): Apache IoTDB: Path Traversal Vulnerability (CVSS 9.1, Apache Software Foundation Apache IoTDB · org.apache.iotdb:…)
- [CVE-2026-12993](https://cve.now/CVE-2026-12993.md): Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset (CVSS 6.5, Red Hat build of Apicurio Registry · io.apicurio:apicurio-r…)
- [CVE-2026-12992](https://cve.now/CVE-2026-12992.md): Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation (CVSS 7.4, Red Hat build of Apicurio Registry · io.apicurio:apicurio-r…)
- [CVE-2026-12975](https://cve.now/CVE-2026-12975.md): Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos (CVSS 8.5, Red Hat build of Apicurio Registry · io.apicurio:apicurio-r…)
- [CVE-2026-11800](https://cve.now/CVE-2026-11800.md): Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion (CVSS 8.1, Red Hat build of Keycloak · Red Hat Data Grid +3)
- [CVE-2026-33871](https://cve.now/CVE-2026-33871.md): Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass (CVSS 8.7, needs attention: First public exploit on GitHub Nov 6, netty · io.netty:netty-codec-http2)
- [CVE-2024-38002](https://cve.now/CVE-2024-38002.md): The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… (CVSS 9.3, Liferay Portal · Liferay DXP +2)
- [CVE-2024-25420](https://cve.now/CVE-2024-25420.md): An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system… (CVSS 7.2, org.igniterealtime.openfire:xmppserver)
- [CVE-2024-23897](https://cve.now/CVE-2024-23897.md): Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character… (CVSS 9.8, KEV, Jenkins Project Jenkins · jenkins +1)
- [CVE-2021-44868](https://cve.now/CVE-2021-44868.md): Mingsoft MS MCMS SQL injection in content list (CVSS 9.8, net.mingsoft:ms-mcms)
- [CVE-2021-44228](https://cve.now/CVE-2021-44228.md): Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (CVSS 10.0, KEV, Apache Software Foundation Apache Log4j2 · org.apache.lo… +4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.