Java
Monthly
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization flaws in the bundled Apache BlazeDS library. This critical vulnerability affects ColdFusion 10 (all updates through 22), ColdFusion 11 (through Update 11), and ColdFusion 2016 (through Update 3). CISA confirms active exploitation in the wild with publicly available exploit code (Exploit-DB 43993), and EPSS scoring at 93.36% (100th percentile) indicates extremely high real-world exploitation likelihood. The network-accessible attack vector requiring no authentication or user interaction makes this a top-priority remediation target for any organization running affected ColdFusion versions.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 89.2%.
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 22.1%.
Remote unauthenticated code execution in SAP NetWeaver Application Server Java (pre-7.3) through the Invoker Servlet allows attackers to bypass authentication and execute arbitrary code. Confirmed actively exploited (CISA KEV) from 2013 through 2016 in 'Detour' attacks targeting SAP business applications. CVSS 10.0 with EPSS 16.90% (95th percentile) indicates both maximum theoretical severity and sustained real-world exploitation. This remains a critical priority for organizations running legacy SAP NetWeaver Java instances despite the vulnerability's age.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.4%.
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.5%.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.4%.
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.3%.
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Java Runtime Environment 7 Update 21 and earlier allows remote attackers to escape the Java sandbox and execute arbitrary code via insufficient access checks in the tracing/serviceability component. Publicly available exploit code exists for this medium-complexity network attack, which achieved a 92.14% EPSS score (100th percentile), indicating extremely high likelihood of exploitation. Oracle addressed this vulnerability in their June 2013 Critical Patch Update, though the exact nature of the serviceability component flaw was not fully disclosed by the vendor.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to achieve arbitrary code execution via crafted URL parameters when the Java Security Manager is misconfigured.
An insecure direct object reference in Fuint through commit 57ec018 lets authenticated members retrieve other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Because bookId is an auto-increment integer, an attacker with a valid member account can enumerate records and obtain contact names, mobile numbers, in-store verification codes, service dates, stores, and remarks. No public exploit identified at time of analysis and no confirmed active exploitation; assessed severity is moderate with low confidentiality impact and no integrity or availability impact.
Unauthenticated order forgery in Waynboot-mall through 2.0.0 allows remote attackers to create fraudulent orders, expose stored shipping details, clear carts, and decrement stock by invoking the internal /callback/order/submit message-queue callback. The endpoint is exposed without authentication by the application's SecurityConfig, so no credentials or user interaction are required; attackers supply arbitrary userId, addressId, and cart IDs in the order JSON. Exploitability hinges on network reachability-an internet-exposed instance is trivially exploitable, whereas an internal-only deployment limits the attack to parties with network access; no public exploit code or active exploitation is identified at time of analysis (CVSS 4.0 base 6.9; independent assessment aligns with CVSS 3.1 base 6.5).
Authentication bypass in Xiaozhi-esp32-server-java through 6.1.0 lets unauthenticated remote attackers request /api/device/ota with a valid MAC address and receive a device WebSocket token, enabling access to that device's channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata. No public exploit was identified at time of analysis, and the assessed risk is MEDIUM rather than top-tier because the attacker must know or enumerate a provisioned device MAC and the OTA endpoint must be network-reachable; impact is bounded to a single device's WebSocket channel rather than full server compromise.
Unsafe Java deserialization in Apache Kylin 4 through 5.0.4 allows an attacker who can control, compromise, or network-spoof the external cache service that Kylin is configured to query to feed crafted serialized objects into the Kylin process and potentially achieve arbitrary code execution, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack is not unconditional: it requires Kylin to be deployed with an external cache backend whose responses the attacker can manipulate, and clusters using a trusted, isolated, authenticated cache are not directly reachable through this path. No public exploit identified at time of analysis, no CISA KEV listing, no EPSS probability is reported, and the source supplied no CVSS score or vector, so exploitation likelihood rests solely on the CWE-502 root cause and the described preconditions.
Authenticated HQL injection in Erupt through version 2.3.0 lets a user who already holds query permission on an entity with a String-keyed linkTree target escape that entity's tree-scoped data filter and read records belonging to other mapped entities. The flaw is reached by posting unescaped quote characters into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, which allows attackers to append always-true OR clauses or boolean subqueries to the generated Hibernate query. Exploitation is not trivial: it depends on valid low-privileged credentials plus a specific data-model configuration (a String-keyed linkTree target with query permission), and the impact is limited to confidentiality - no write or availability effect - so this is best treated as a moderate-priority authorization/data-exposure issue, and no public exploit code has been identified at time of analysis.
Server-side request forgery in bitcoinj 0.17 and earlier allows an attacker who can supply or influence a BIP70-style payment request to force the host to issue outbound HTTP connections to an attacker-chosen endpoint by manipulating the pki_type argument handled by PaymentSession.java. Only applications that actually parse payment requests through the Payment Request Handler are exposed, so deployments that never process BIP70 messages are not affected; remote, unauthenticated exploitation is possible with publicly available exploit code exists, though the impact is bounded to low confidentiality, integrity, and availability loss rather than code execution. The bitcoinj project was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Authentication bypass in Scoold (Erudika) prior to 1.69.1 allows an attacker who already possesses one of the server signing secrets - app_secret_key or para_secret_key - to forge a JWT that is accepted for the /api/config and /api/stats endpoints and mapped to the hardcoded administrative API_USER, thereby reading sensitive configuration and server logs and reaching privileged configuration functionality. An ordinary user login-session token is explicitly insufficient for this attack, and the vulnerable check runs even when scoold.api_enabled is false, so turning off the API is not a mitigation. No public exploit code and no confirmed active exploitation were identified at time of analysis; because the attack hinges entirely on obtaining a server-side signing secret, the input CVSS of 6.1 (assessed vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a medium-severity, heavily preconditioned issue rather than an open, remotely reachable bypass.
Open redirect in Scoold, Erudika's Java-based Q&A and knowledge-sharing platform, affects every release prior to 1.69.1, where the backto and returnto parameters handled by HttpUtils.getBackToUrl() are validated with a case-insensitive prefix match against the configured server URL. An unauthenticated attacker can craft a sign-in link whose backto value is an absolute URL on a look-alike host such as example.com.evil.com; URI.resolve() retains the attacker URL, the prefix check passes, and the victim is redirected to the attacker's domain after completing authentication. The result is phishing and possible credential or token theft on the malicious site, but exploitation hinges on the victim following the crafted link and signing in (UI:R); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Cross-origin request forgery in Erudika Scoold prior to 1.69.1 lets any attacker-controlled website issue credentialed API calls against an authenticated user's session, exposing user data, questions, and server configuration, and allowing state-changing actions on the victim's behalf. The CORS filter combines a wildcard origin pattern with credential support, so any requesting origin is reflected back with Access-Control-Allow-Credentials, meaning the only barriers are that the victim must have a live Scoold session in the same browser and must be lured to the attacker's page (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R, CWE-346). No public exploit code has been identified and the issue is not in CISA KEV; the vendor-released patch is version 1.69.1, which replaces the wildcard with a same-origin default or an explicit allowlist via the new cors_allowed_origins setting.
Local information disclosure and symlink-following file overwrite in AsyncHttpClient versions 2.0.0 through 2.16.0 and 3.x before 3.0.12 let an authenticated local user on a shared multi-user host read resumable download URLs - including embedded credentials and query tokens - from a predictably named store at $java.io.tmpdir/ahc/ResumableAsyncHandler.properties, or plant a symbolic link that the client follows when saving state, truncating and overwriting any file writable by the client process. Only applications that decorate another AsyncHandler with ResumableAsyncHandler backed by PropertiesBasedResumableProcessor are exposed; the no-argument constructors use a no-op processor and are unaffected. Exploitation requires local access, control of the shared $java.io.tmpdir/ahc directory, and timing against a state save; no public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation. The issue is fixed in 2.16.1 and 3.0.12.
Java class-enumeration through the ExtDirect endpoint in Sonatype Nexus Repository 3 allows an unauthenticated, remote attacker to pass attacker-controlled input into a Java class loading call and thereby determine whether specific classes are present in the application, a low-impact information-disclosure issue that does not by itself permit code execution. The attack requires no authentication or user interaction (CVSS v4.0 PR:N/UI:N, assessed CVSS v3.1 6.9-equivalent AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is limited to instances of Nexus Repository 3 running versions prior to the 3.97.0 fix that expose the ExtDirect endpoint on an reachable network interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the 'RCE' tag in the source feed is misleading because the vendor description explicitly states the flaw does not achieve code execution.
Excessive resource consumption in OW2 ASM versions 1.4.3 through 9.10.x allows an unauthenticated local attacker to trigger a denial of service by supplying a crafted Java class file that is analyzed through Analyzer.analyze() with the BasicVerifier, SimpleVerifier, or SourceInterpreter implementations. The flaw, tracked as CWE-770, causes unbounded per-instruction Frame allocation and fix-point iteration, exhausting memory and CPU; exploitation requires the victim application to invoke the analysis path (user interaction) and is limited to availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is rated medium severity with a vendor patch available in ASM 9.11.
Uncontrolled recursion in OW2 ASM's SignatureReader.parseType() lets an attacker crash any application that reads or transforms a malicious Java class file, exhausting the stack with deeply nested generic type arguments in the class's Signature attribute. Versions 3.0 through 9.10.x (everything before 9.11) are affected; the flaw is availability-only, yielding at worst a StackOverflowError that kills the processing thread or service, with no confidentiality or integrity impact. Exploitation is local-vector and requires the victim application to actively ingest the crafted bytecode, for example through uploaded plugins, user-submitted classes, third-party build artifacts, or instrumentation input; there is no public exploit code identified at time of analysis and no indication of confirmed active exploitation (CISA KEV), and deployments that only ever parse trusted first-party bytecode are not realistically exposed.
Excessive memory allocation in the asm-commons AdviceAdapter of OW2 ASM (versions 3.1 through 9.10.x, fixed in 9.11) lets an attacker who can get crafted bytecode processed by a tool that uses AdviceAdapter drive the JVM into hundreds of megabytes of allocation and ultimately a denial of service. The flaw is triggered by class files whose constructors contain many forward jump targets, causing unbounded stack-frame copying in the forwardJumpStackFrames handling; exploitation is local (AV:L) and requires the victim process to be induced to ingest the malicious class file (UI:P/UI:R), with impact limited to availability (VA:L) and no confidentiality or integrity effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, and the vendor has released a fix, so this is a genuine-but-modest-priority issue rather than a high-severity emergency.
CPU exhaustion in the OW2 ASM Java bytecode library (versions 3.0 through 9.10.x) lets attackers who can supply crafted class files stall bytecode-transforming threads for an unbounded amount of time whenever ClassWriter is used with the COMPUTE_FRAMES option. The crafted methods force the fix-point algorithm in MethodWriter.computeAllFrames() to converge very slowly, consuming CPU indefinitely; only availability is affected, with no confidentiality or integrity impact. The attack path is local and requires passive user interaction (a user or application must feed the crafted file into the ASM transformation call path), so exposure is limited to deployments that recompute frames on untrusted or externally influenced bytecode. Patch available per the vendor advisory, and no public exploit identified at time of analysis.
Denial of service in OW2 ASM versions 3.0 through 9.10.x allows a crafted class file to exhaust JVM heap memory when an application analyzes untrusted bytecode with the ClassWriter COMPUTE_MAXS or COMPUTE_FRAMES option enabled. A malicious class containing thousands of overlapping exception handlers triggers quadratic Edge allocation inside MethodWriter.computeMaxStackAndLocal() and computeAllFrames(), producing an OutOfMemoryError that crashes the JVM. The vendor scores this CVSS 4.0 6.8 (AV:L, PR:N, UI:P) with high availability impact only, and no public exploit or confirmed in-the-wild exploitation has been identified; the attack is bounded by the requirement that the victim application load attacker-controlled bytecode through ASM's frame-computation path.
Denial of service in OW2 ASM versions 3.0 through 9.10.x (prior to 9.11) allows an attacker to crash applications that transform untrusted Java class files by supplying a class with a large method containing many long forward jumps, which triggers unbounded recursion in ClassWriter.replaceAsmInstructions() and a StackOverflowError during toByteArray(). The issue is rated moderate severity (CVSS 6.8) and requires the target application to process attacker-controlled bytecode through ClassWriter's transformation path; no public exploit code or active exploitation has been identified, and a vendor patch is available in ASM 9.11. The attack vector is local and requires passive user interaction, with impact limited to availability.
Denial of service in OW2 ASM (versions 3.0 up to but not including 9.11) allows an attacker who can get a crafted Java class file into the library's bytecode parsing pipeline to trigger a roughly 2 GB heap allocation that crashes the JVM. The root cause is that Label.addSubroutineRetSuccessors() fails to enforce ASM's single-RET-per-JSR invariant, so a malformed class file containing multiple RET instructions for one JSR expands the successor set to an enormous size (CWE-789, excessive memory allocation). Impact is availability-only - no code execution or data disclosure - and exploitation requires an application that hands untrusted class files to ASM and reaches the legacy JSR/RET parsing path; the vendor CVSS 4.0 base score is 6.8 (AV:L, UI:P, PR:N), and the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. medium severity and availability-only. No public exploit identified at time of analysis, and there is no evidence of active exploitation.
Denial of service in OW2 ASM 5.0 through 9.10.x allows an attacker who can supply a crafted Java class file to trigger excessive memory allocation while ClassReader parses a BootstrapMethods attribute, causing an OutOfMemoryError that crashes the JVM or the consuming thread. This is a pure availability issue (CVSS 6.8, CWE-789) with no code execution, data disclosure, or integrity impact, and it requires the victim application to parse untrusted bytecode (PR:N, UI:P/UI:R). No public exploit was identified at time of analysis; a vendor patch is available.
Command injection and buffer overflow weaknesses in HPE NonStop Java JToolkit can let a locally positioned, already highly privileged attacker corrupt memory or execute unintended commands within the JToolkit process, with impact limited to low confidentiality, integrity, and availability effects (CVSS 3.1 base 3.8, Low). Exploitation is not remote: it requires pre-existing high local privileges (PR:H), local access to the NonStop system (AV:L), a separate user interaction that supplies attacker-influenced input to the vulnerable routine (UI:R), and additional non-deterministic conditions captured by high attack complexity (AC:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), so all available CVSS signals point to a low real-world priority.
Denial of service in ESA's SLE API for Java (all versions prior to 5.1.7) allows an unauthenticated remote client of the SLE listening service to crash or degrade the service by sending a crafted ISP1 TML/PDU message whose 4-byte big-endian body-length field drives an unbounded byte-array allocation. Because the CVSS vector is PR:N/UI:N and no non-default feature toggle is required, any network-reachable instance in a standard configuration is exposed; however, the practical attacker set is narrowed by the fact that SLE endpoints are typically confined to space-agency ground-segment operational networks rather than the public internet. The flaw is fixed in 5.1.7, and no public exploit code was identified at time of analysis.
Denial of service in the ConnectBot cbssh/sshlib SSH client library (all versions through 0.3.0) lets a malicious or compromised SSH server crash the client process by returning a small malformed packet whose inner length or element-count fields are far larger than the containing packet. The Kaitai Struct Java runtime allocates an array using the attacker-declared length before it notices the input is truncated, producing excessive allocation and an uncaught OutOfMemoryError that terminates the host application; a second, narrower path exists through malformed SSH-agent messages, but only when SSH agent forwarding is enabled. The vulnerable client must initiate a connection to the hostile server (user interaction), which is the main limiting factor; there is no confidentiality or integrity impact, no authentication is required on the general transport path (CVSS 4.0 vector PR:N, UI:A), and no public exploit code was identified at time of analysis. The issue is fixed in version 0.3.1 and is not confirmed as actively exploited (CISA KEV).
Server-side request forgery in Conductor OSS through 3.33.0-rc10 lets remote attackers influence the kafka_request.bootStrapServers argument handled by KafkaPublishTask.start in the Kafka contrib module, causing the Conductor server to connect to an attacker-chosen Kafka bootstrap endpoint. The issue is CWE-918; VulDB rates it CVSS 4.0 5.5, while our independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:L/I:L/A:L and characterizes the practical impact as low, with publicly available exploit code existing but CISA KEV active exploitation not indicated in the provided data. Although the CVSS vector is PR:N, practical exploitation requires that the Kafka contrib module is deployed, that a usable KafkaPublishTask exists, and that the attacker can create or execute a workflow/task controlling the bootstrap-servers argument, so deployments that enforce authentication/authorization on workflow submission or are not internet-exposed are substantially less exposed.
Server-side request forgery in conductor-oss Conductor through 3.33.0-rc10 allows unauthenticated remote attackers to induce the Agentspan Agent Runtime to make crafted requests to arbitrary URLs via AgentController.java (CWE-918). The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) limits impact to confidentiality only, and the CVSS 4.0 vector's E:P metric indicates publicly available exploit code exists; no CISA KEV listing or confirmed active exploitation was provided. Realistic risk is moderate and hinges on whether the Conductor instance is internet-facing and what internal services or cloud metadata endpoints are reachable from the server.
Server-side request forgery in Conductor OSS through 3.32.5 allows unauthenticated remote attackers to force the server to fetch attacker-controlled URLs through the A2A Agent Card Fetching endpoint when the AI/a2a feature is enabled and reachable. The vulnerable path is A2AService.getAgentCard, where the agentUrl argument can be manipulated to reach internal services; publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is indicated. The independent assessment rates this as moderate with low confidentiality, integrity, and availability impact, and exploitation is realistic only where the A2A agent-card functionality is exposed.
Server-side request forgery (CWE-918) in the MCP Service of conductor-oss Conductor 3.22.0 lets an authenticated low-privilege user who can invoke the listTools operation supply a crafted mcpServer argument and cause the Conductor server to issue requests to attacker-chosen destinations. The impact is scored low (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because authentication is required, the vulnerable path is only reachable when the MCP integration is enabled and exposed, and there is no scope change to downstream systems. Publicly available exploit code exists for this issue, but there is no confirmation of active exploitation, and no EPSS or CISA KEV data was provided.
Server-side request forgery in conductor-oss Conductor 3.31.2 allows an authenticated low-privileged user to force the server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted specUrl when defining an API tool, since ListApiToolsTask.start processes that argument without validating or restricting the target address. Successful abuse can expose internal-only services, loopback interfaces, and cloud instance metadata reachable from the Conductor host, with the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:L/A:N) reflecting limited confidentiality and integrity impact and no availability effect. Publicly available exploit code exists and the flaw is disclosed via VulDB; there is no indication of confirmed active exploitation (not in CISA KEV), and exploitation requires a valid low-privileged account that can create or modify API tool definitions plus a network position where internal targets are actually reachable.
Server-side request forgery in Fit2Cloud MeterSphere up to 3.6.9-lts allows an authenticated low-privilege user to make the server issue outbound HTTP requests to an attacker-chosen URL by manipulating the swaggerUrl argument handled by Swagger3ParserApiDefinition.testUrlTimeout in the Swagger3 API-definition import component. Publicly available exploit code exists and the vendor was contacted but did not respond, so no fix is confirmed; the flaw is network-reachable (AV:N) and needs no user interaction, but it requires valid credentials plus access to the API-import feature, which keeps it a moderate priority rather than an urgent one. Real-world impact depends on what the MeterSphere host can reach internally - internal services, admin interfaces, or cloud metadata endpoints - and the assessed impact is limited to low confidentiality exposure (C:L, I:N, A:N).
Open redirect in PublicCMS through 5.202608.a lets unauthenticated remote attackers send users to arbitrary external sites by crafting the returnUrl parameter processed by SafeConfigComponent.getSafeUrl in the pay endpoint. Publicly available exploit code exists, and exploitation requires a victim to follow an attacker-supplied link (social engineering), with impact limited to browser redirection. The vendor was contacted but did not respond, and the independent assessment rates this as a low-priority issue despite remote reachability.
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).
SQL injection in the Autocomplete Handler of erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows remote attackers who already hold a valid low-privilege account to manipulate the trem, searchField, or entityName arguments passed to CommonServiceImpl.getAutoList and execute arbitrary SQL against the backend database, exposing data reachable by that account. Publicly available exploit code exists, so the attack is practical for any user able to authenticate and reach the endpoint; the vector's E:P rating and the reporter's note that the exploit was made public confirm exploitability, though there is no CISA KEV listing indicating confirmed active exploitation. The vendor was contacted early but never responded, and no vendor-released patched version has been identified.
SQL injection in the JEEWMS warehouse management system (erzhongxmu JEEWMS through build 2026.09.27-W39) lets an authenticated low-privilege user execute arbitrary SQL by manipulating the 'searchstr' argument handled by WmInQmIController.list in the Inbound Quality Check PDA interface. The vulnerability is remotely reachable (CVSS:4.0 base 2.1; assessed CVSS:3.1 6.3, AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity and availability impact), so the primary constraint on exploitation is that the attacker needs a valid low-privilege account - it is not exploitable by fully unauthenticated parties. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is currently identified; the issue is not in CISA KEV and real-world priority is low given the authentication prerequisite and the niche deployment footprint of this product.
Authenticated SQL injection in erzhongxmu JEEWMS through version 2026.09.27-W39 allows remote low-privileged users to execute arbitrary SQL via the 'searchstr' parameter in the PDA interface's WmToMoveGoodsController.list endpoint. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (CISA KEV) has been reported. The vendor did not respond to disclosure, and no vendor-released patch has been identified, so risk is moderate and depends on limiting exposure of the PDA interface.
SQL injection in erzhongxmu JEEWMS (versions up to and including 2026.09.27-W39) lets an authenticated low-privileged user inject arbitrary SQL through the 'searchstr' argument of the WmSttInGoodsController.list endpoint, potentially reading, tampering with, or disrupting warehouse-management data. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; there is no confirmed active exploitation (CISA KEV). With an assessed CVSS:4.0 base score of 5.3 and low confidentiality, integrity, and availability impact, this is a moderate-priority issue whose main limiting factor is the authentication prerequisite - anonymous, unauthenticated users cannot reach the vulnerable code path.
SQL injection in the erzhongxmu JEEWMS warehouse management system (versions up to 2026.09.27-W39) allows an authenticated user to inject arbitrary SQL through the 'searchstr' argument processed by the WvGiController.list endpoint, enabling unauthorized reads of database contents and potentially modification or deletion of records. Both the supplied CVSS 4.0 vector (PR:L, E:P) and our independent assessment require a valid low-privilege session before the payload can be delivered, which keeps the rating moderate (CVSS 4.0 base 5.3) and bounds realistic exploitation to insiders or attackers who have already acquired credentials rather than anonymous internet-wide attacks. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix has been published at time of analysis.
SQL injection in erzhongxmu JEEWMS (warehouse management system) through 2026.09.27-W39 lets an authenticated remote user inject arbitrary SQL via the 'searchstr' argument of the notice search endpoint handled by WvNoticeController.list. Publicly available exploit code exists, and the maintainer was contacted early but did not respond, so no vendor-supplied fix has been published; there is no indication of confirmed active exploitation (no CISA KEV entry). Impact is bounded by the privileges of the application's database account (Low confidentiality, integrity, and availability), and exploitation requires a valid low-privileged session (CVSS PR:L).
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows an authenticated remote attacker to inject arbitrary SQL through the binstore, binid, des, or cengshu parameters handled by the getbinall and getbinallagv functions of MdBinController.java, potentially reading or altering database content. The CVSS v4.0 base score is 5.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting low-level confidentiality, integrity, and availability impact rather than full database takeover. A public exploit has been published and may be used, but there is no KEV confirmation of active exploitation; the vendor was contacted and did not respond, so no official fix is documented. Because exploitation requires a valid low-privileged JEEWMS session (PR:L in the assessed vector), risk is concentrated in deployments where the warehouse management interface is network-reachable and credentials are shared or weakly managed.
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) lets an authenticated attacker who supplies a crafted 'goodscode' argument to the docheck handler in WmOmNoticeHController.java manipulate the underlying SQL query. The CVSS v4.0 score is only 2.1 (Low) and our independent re-scoring lands at CVSS 3.1 5.4 (Medium) because exploitation requires a valid low-privileged session (PR:L), yields limited confidentiality and integrity impact, and is confined to one parameter of one controller. Exploit code is publicly available, but there is no CISA KEV entry and no evidence of active exploitation; the vendor was contacted and did not respond, so no official patch is identified. Overall this should be treated as a low-priority hardening item rather than an urgent exposure.
SQL injection in JeeWMS up to and including 3.7 lets an authenticated remote user inject arbitrary HQL through the 'searchVal' parameter of the getTreeData function in JeecgFormDemoController.java, allowing manipulation of the underlying database query. Exploitation requires a valid application session with access to the Autocomplete Data Handler endpoint, which resides in a demo/sample controller (com.jeecg.demo) that may not be exposed in every deployment, so this is a moderate, authentication-gated issue rather than an emergency; no public exploit code has been identified at time of analysis and no EPSS score was provided. The upstream project has published a fix in commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 (PR #4), which switches the vulnerable string concatenation to a parameterized query.
Missing authorization in the JeecgBoot SysPositionController removeUserPosition handler (versions through 3.9.5) allows any authenticated low-privileged user to delete user-to-position mappings in the sys_user_position table by sending DELETE requests with arbitrary userId and positionId values. The attacker gains no confidentiality or code execution, but can silently unbind users from their positions, and the deletions are performed without logging, which hampers detection and attribution. Publicly available exploit code exists (a Python PoC referenced by VulnCheck) and the issue is tracked as CWE-862; no CISA KEV listing indicating confirmed active exploitation was provided. Independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (assessed score consistent with the reported 5.3 base), this is a genuine-but-moderate priority issue requiring a valid authenticated account rather than a critical emergency.
Mall4j through version 4.0 allows any authenticated storefront customer to delete other shoppers' cart entries for off-shelf products by sending a single DELETE request to the /p/shopCart/cleanExpiryProdList endpoint, exploiting an operator precedence error in the cleanExpiryProdList SQL statement that fails to scope the deletion to the caller. This improper authorization flaw (CWE-783) has a CVSS 4.0 score of 5.3 with low integrity and availability impact and no confidentiality impact (PR:L), and publicly available exploit code exists. It is not listed in CISA KEV, and no active exploitation has been confirmed.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated, low-privileged user send spoofed template announcements by POSTing to /sys/api/sendTemplateAnnouncement with attacker-chosen sender, recipient, title, and template parameters, so the resulting messages appear to come from admin or system accounts. Rated 5.3 (medium), the issue carries only low integrity impact with no confidentiality or availability effect and no path to code execution, and it requires the attacker to already hold a valid JeecgBoot session. Publicly available exploit code exists (VulnCheck-reported POC plus a GitHub PoC script), though there is no indication of confirmed active exploitation.
Missing authorization in JeecgBoot (all versions through 3.9.5) lets any authenticated, low-privileged user alter tenant administrator application status for arbitrary tenants by sending a PUT request to /sys/tenant/updateApplyStatus with a tenant id they do not own. The endpoint performs no ownership or role check on the supplied identifier, so an ordinary account - including one obtained through self-registration - can toggle the applyStatus field and thereby enable or disable tenant-admin applications across the entire instance. Publicly available exploit code exists (a Python PoC is published in a public GitHub repository), though this is not confirmed as actively exploited in the wild; EPSS and KEV data were not provided, and the independent assessment rates this as a moderate-severity broken access control issue with limited blast radius, since impact is confined to status toggling rather than full tenant takeover.
Authenticated low-privileged users can delete department permission bindings in JeecgBoot through 3.9.5 by calling the SysDepartPermissionController delete handler, which performs no authorization check (CWE-862). Because the corresponding list endpoint is also unguarded, an attacker can enumerate the required row ids and then issue DELETE requests that strip menu and button grants from department roles, degrading the instance's RBAC configuration. Publicly available exploit code exists, and the flaw affects default deployments, but the impact is bounded to integrity/availability of permission data - no data disclosure and no privilege escalation beyond RBAC degradation - which is why the vendor score is a moderate 5.3.
Any authenticated JeecgBoot user - regardless of privilege level - can add, modify or clear department data-rule bindings by POSTing departId, permissionId and dataRuleIds to /sys/sysDepartPermission/datarule, because the saveDatarule handler in SysDepartPermissionController performs no authorization check, in versions through 3.9.5. Publicly available exploit code exists, but no active exploitation is confirmed (not in CISA KEV). With a CVSS 5.3 rating reflecting network reachability, low privileges required and only low integrity impact, realistic risk concentrates in multi-department or multi-tenant deployments where untrusted low-privilege accounts exist.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user read role data-rule metadata - rule names, columns, conditions, values and bound rule IDs - for arbitrary roles via GET /sys/role/datarule/{permissionId}/{roleId}. The loadDatarule handler in SysRoleController omits the authorization check that its sibling endpoints enforce, so a low-privileged account (PR:L, unauthenticated access does not work) can enumerate permissionId/roleId pairs and exfiltrate the row-level access-control policy of the whole tenant. Impact is information disclosure only (CWE-862, no write, no code execution); publicly available exploit code exists, and the CVE is not in CISA KEV.
Missing authorization in the JeecgBoot SysPositionController edit handler (/sys/position/edit) lets any authenticated low-privileged account rewrite organizational position names, codes, and ranks via crafted PUT or POST requests, affecting JeecgBoot through 3.9.5. Because the position list endpoint is also unguarded, an attacker can first enumerate valid position IDs and then target them directly, so no guesswork or elevated role is required. Impact is confined to the integrity of position reference data - there is no confidentiality or availability loss and no escalation to system compromise - and the issue is correctly rated medium (CVSS 5.3); publicly available exploit code exists, while no CISA KEV active-exploitation entry is indicated.
Any authenticated user, including low-privileged accounts, can delete organizational positions in JeecgBoot 3.9.5 and earlier by exploiting a missing authorization check in the SysPositionController deleteBatch handler. Attackers harvest valid position IDs from an unguarded list endpoint and submit them as a comma-separated list, destroying sys_position records and orphaning user-position assignments. This is a moderate-severity data-destruction issue, reflected by the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; publicly available exploit code exists, but no active exploitation is confirmed in CISA KEV.
Heap memory corruption in Apache DataSketches C++ (datasketches-cpp) versions 4.1.0 through 5.2.0 allows remote attackers to trigger out-of-bounds reads and writes via a crafted Count-Min sketch submitted to the deserialize() function. The flaw combines a missing preamble size check that permits up to 16 bytes over-read on truncated input, and a 32-bit integer overflow in the serialized bucket count that can wrap to zero, resulting in an empty table and subsequent heap memory corruption during updates or estimate queries. Exploitation requires an application to deserialize Count-Min sketches from untrusted sources; no public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the severity as moderate.
Double-release of pooled decompression buffers in Xerial snappy-java 1.1.7.4 through 1.1.10.9 lets a crafted Snappy framed stream corrupt or expose data belonging to another, concurrently active stream. An attacker-supplied frame that declares an oversized chunk length forces the replacement buffer allocation to fail with OutOfMemoryError, after which the failed path still treats the already-released pooled buffer as live and returns it to the pool a second time, so the same backing array can be handed to a second stream. The flaw is remote and unauthenticated (CVSS:4.0 vector PR:N) but opportunistic rather than deterministic, requires the target to decompress untrusted framed input through SnappyFramedInputStream while drawing from a shared buffer pool, and carries no public exploit identified at time of analysis; overall risk is medium severity rather than urgent emergency.
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization flaws in the bundled Apache BlazeDS library. This critical vulnerability affects ColdFusion 10 (all updates through 22), ColdFusion 11 (through Update 11), and ColdFusion 2016 (through Update 3). CISA confirms active exploitation in the wild with publicly available exploit code (Exploit-DB 43993), and EPSS scoring at 93.36% (100th percentile) indicates extremely high real-world exploitation likelihood. The network-accessible attack vector requiring no authentication or user interaction makes this a top-priority remediation target for any organization running affected ColdFusion versions.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 89.2%.
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 22.1%.
Remote unauthenticated code execution in SAP NetWeaver Application Server Java (pre-7.3) through the Invoker Servlet allows attackers to bypass authentication and execute arbitrary code. Confirmed actively exploited (CISA KEV) from 2013 through 2016 in 'Detour' attacks targeting SAP business applications. CVSS 10.0 with EPSS 16.90% (95th percentile) indicates both maximum theoretical severity and sustained real-world exploitation. This remains a critical priority for organizations running legacy SAP NetWeaver Java instances despite the vulnerability's age.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.4%.
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.5%.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.4%.
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.3%.
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Java Runtime Environment 7 Update 21 and earlier allows remote attackers to escape the Java sandbox and execute arbitrary code via insufficient access checks in the tracing/serviceability component. Publicly available exploit code exists for this medium-complexity network attack, which achieved a 92.14% EPSS score (100th percentile), indicating extremely high likelihood of exploitation. Oracle addressed this vulnerability in their June 2013 Critical Patch Update, though the exact nature of the serviceability component flaw was not fully disclosed by the vendor.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to achieve arbitrary code execution via crafted URL parameters when the Java Security Manager is misconfigured.
An insecure direct object reference in Fuint through commit 57ec018 lets authenticated members retrieve other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Because bookId is an auto-increment integer, an attacker with a valid member account can enumerate records and obtain contact names, mobile numbers, in-store verification codes, service dates, stores, and remarks. No public exploit identified at time of analysis and no confirmed active exploitation; assessed severity is moderate with low confidentiality impact and no integrity or availability impact.
Unauthenticated order forgery in Waynboot-mall through 2.0.0 allows remote attackers to create fraudulent orders, expose stored shipping details, clear carts, and decrement stock by invoking the internal /callback/order/submit message-queue callback. The endpoint is exposed without authentication by the application's SecurityConfig, so no credentials or user interaction are required; attackers supply arbitrary userId, addressId, and cart IDs in the order JSON. Exploitability hinges on network reachability-an internet-exposed instance is trivially exploitable, whereas an internal-only deployment limits the attack to parties with network access; no public exploit code or active exploitation is identified at time of analysis (CVSS 4.0 base 6.9; independent assessment aligns with CVSS 3.1 base 6.5).
Authentication bypass in Xiaozhi-esp32-server-java through 6.1.0 lets unauthenticated remote attackers request /api/device/ota with a valid MAC address and receive a device WebSocket token, enabling access to that device's channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata. No public exploit was identified at time of analysis, and the assessed risk is MEDIUM rather than top-tier because the attacker must know or enumerate a provisioned device MAC and the OTA endpoint must be network-reachable; impact is bounded to a single device's WebSocket channel rather than full server compromise.
Unsafe Java deserialization in Apache Kylin 4 through 5.0.4 allows an attacker who can control, compromise, or network-spoof the external cache service that Kylin is configured to query to feed crafted serialized objects into the Kylin process and potentially achieve arbitrary code execution, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack is not unconditional: it requires Kylin to be deployed with an external cache backend whose responses the attacker can manipulate, and clusters using a trusted, isolated, authenticated cache are not directly reachable through this path. No public exploit identified at time of analysis, no CISA KEV listing, no EPSS probability is reported, and the source supplied no CVSS score or vector, so exploitation likelihood rests solely on the CWE-502 root cause and the described preconditions.
Authenticated HQL injection in Erupt through version 2.3.0 lets a user who already holds query permission on an entity with a String-keyed linkTree target escape that entity's tree-scoped data filter and read records belonging to other mapped entities. The flaw is reached by posting unescaped quote characters into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, which allows attackers to append always-true OR clauses or boolean subqueries to the generated Hibernate query. Exploitation is not trivial: it depends on valid low-privileged credentials plus a specific data-model configuration (a String-keyed linkTree target with query permission), and the impact is limited to confidentiality - no write or availability effect - so this is best treated as a moderate-priority authorization/data-exposure issue, and no public exploit code has been identified at time of analysis.
Server-side request forgery in bitcoinj 0.17 and earlier allows an attacker who can supply or influence a BIP70-style payment request to force the host to issue outbound HTTP connections to an attacker-chosen endpoint by manipulating the pki_type argument handled by PaymentSession.java. Only applications that actually parse payment requests through the Payment Request Handler are exposed, so deployments that never process BIP70 messages are not affected; remote, unauthenticated exploitation is possible with publicly available exploit code exists, though the impact is bounded to low confidentiality, integrity, and availability loss rather than code execution. The bitcoinj project was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Authentication bypass in Scoold (Erudika) prior to 1.69.1 allows an attacker who already possesses one of the server signing secrets - app_secret_key or para_secret_key - to forge a JWT that is accepted for the /api/config and /api/stats endpoints and mapped to the hardcoded administrative API_USER, thereby reading sensitive configuration and server logs and reaching privileged configuration functionality. An ordinary user login-session token is explicitly insufficient for this attack, and the vulnerable check runs even when scoold.api_enabled is false, so turning off the API is not a mitigation. No public exploit code and no confirmed active exploitation were identified at time of analysis; because the attack hinges entirely on obtaining a server-side signing secret, the input CVSS of 6.1 (assessed vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a medium-severity, heavily preconditioned issue rather than an open, remotely reachable bypass.
Open redirect in Scoold, Erudika's Java-based Q&A and knowledge-sharing platform, affects every release prior to 1.69.1, where the backto and returnto parameters handled by HttpUtils.getBackToUrl() are validated with a case-insensitive prefix match against the configured server URL. An unauthenticated attacker can craft a sign-in link whose backto value is an absolute URL on a look-alike host such as example.com.evil.com; URI.resolve() retains the attacker URL, the prefix check passes, and the victim is redirected to the attacker's domain after completing authentication. The result is phishing and possible credential or token theft on the malicious site, but exploitation hinges on the victim following the crafted link and signing in (UI:R); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Cross-origin request forgery in Erudika Scoold prior to 1.69.1 lets any attacker-controlled website issue credentialed API calls against an authenticated user's session, exposing user data, questions, and server configuration, and allowing state-changing actions on the victim's behalf. The CORS filter combines a wildcard origin pattern with credential support, so any requesting origin is reflected back with Access-Control-Allow-Credentials, meaning the only barriers are that the victim must have a live Scoold session in the same browser and must be lured to the attacker's page (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R, CWE-346). No public exploit code has been identified and the issue is not in CISA KEV; the vendor-released patch is version 1.69.1, which replaces the wildcard with a same-origin default or an explicit allowlist via the new cors_allowed_origins setting.
Local information disclosure and symlink-following file overwrite in AsyncHttpClient versions 2.0.0 through 2.16.0 and 3.x before 3.0.12 let an authenticated local user on a shared multi-user host read resumable download URLs - including embedded credentials and query tokens - from a predictably named store at $java.io.tmpdir/ahc/ResumableAsyncHandler.properties, or plant a symbolic link that the client follows when saving state, truncating and overwriting any file writable by the client process. Only applications that decorate another AsyncHandler with ResumableAsyncHandler backed by PropertiesBasedResumableProcessor are exposed; the no-argument constructors use a no-op processor and are unaffected. Exploitation requires local access, control of the shared $java.io.tmpdir/ahc directory, and timing against a state save; no public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation. The issue is fixed in 2.16.1 and 3.0.12.
Java class-enumeration through the ExtDirect endpoint in Sonatype Nexus Repository 3 allows an unauthenticated, remote attacker to pass attacker-controlled input into a Java class loading call and thereby determine whether specific classes are present in the application, a low-impact information-disclosure issue that does not by itself permit code execution. The attack requires no authentication or user interaction (CVSS v4.0 PR:N/UI:N, assessed CVSS v3.1 6.9-equivalent AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is limited to instances of Nexus Repository 3 running versions prior to the 3.97.0 fix that expose the ExtDirect endpoint on an reachable network interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the 'RCE' tag in the source feed is misleading because the vendor description explicitly states the flaw does not achieve code execution.
Excessive resource consumption in OW2 ASM versions 1.4.3 through 9.10.x allows an unauthenticated local attacker to trigger a denial of service by supplying a crafted Java class file that is analyzed through Analyzer.analyze() with the BasicVerifier, SimpleVerifier, or SourceInterpreter implementations. The flaw, tracked as CWE-770, causes unbounded per-instruction Frame allocation and fix-point iteration, exhausting memory and CPU; exploitation requires the victim application to invoke the analysis path (user interaction) and is limited to availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is rated medium severity with a vendor patch available in ASM 9.11.
Uncontrolled recursion in OW2 ASM's SignatureReader.parseType() lets an attacker crash any application that reads or transforms a malicious Java class file, exhausting the stack with deeply nested generic type arguments in the class's Signature attribute. Versions 3.0 through 9.10.x (everything before 9.11) are affected; the flaw is availability-only, yielding at worst a StackOverflowError that kills the processing thread or service, with no confidentiality or integrity impact. Exploitation is local-vector and requires the victim application to actively ingest the crafted bytecode, for example through uploaded plugins, user-submitted classes, third-party build artifacts, or instrumentation input; there is no public exploit code identified at time of analysis and no indication of confirmed active exploitation (CISA KEV), and deployments that only ever parse trusted first-party bytecode are not realistically exposed.
Excessive memory allocation in the asm-commons AdviceAdapter of OW2 ASM (versions 3.1 through 9.10.x, fixed in 9.11) lets an attacker who can get crafted bytecode processed by a tool that uses AdviceAdapter drive the JVM into hundreds of megabytes of allocation and ultimately a denial of service. The flaw is triggered by class files whose constructors contain many forward jump targets, causing unbounded stack-frame copying in the forwardJumpStackFrames handling; exploitation is local (AV:L) and requires the victim process to be induced to ingest the malicious class file (UI:P/UI:R), with impact limited to availability (VA:L) and no confidentiality or integrity effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, and the vendor has released a fix, so this is a genuine-but-modest-priority issue rather than a high-severity emergency.
CPU exhaustion in the OW2 ASM Java bytecode library (versions 3.0 through 9.10.x) lets attackers who can supply crafted class files stall bytecode-transforming threads for an unbounded amount of time whenever ClassWriter is used with the COMPUTE_FRAMES option. The crafted methods force the fix-point algorithm in MethodWriter.computeAllFrames() to converge very slowly, consuming CPU indefinitely; only availability is affected, with no confidentiality or integrity impact. The attack path is local and requires passive user interaction (a user or application must feed the crafted file into the ASM transformation call path), so exposure is limited to deployments that recompute frames on untrusted or externally influenced bytecode. Patch available per the vendor advisory, and no public exploit identified at time of analysis.
Denial of service in OW2 ASM versions 3.0 through 9.10.x allows a crafted class file to exhaust JVM heap memory when an application analyzes untrusted bytecode with the ClassWriter COMPUTE_MAXS or COMPUTE_FRAMES option enabled. A malicious class containing thousands of overlapping exception handlers triggers quadratic Edge allocation inside MethodWriter.computeMaxStackAndLocal() and computeAllFrames(), producing an OutOfMemoryError that crashes the JVM. The vendor scores this CVSS 4.0 6.8 (AV:L, PR:N, UI:P) with high availability impact only, and no public exploit or confirmed in-the-wild exploitation has been identified; the attack is bounded by the requirement that the victim application load attacker-controlled bytecode through ASM's frame-computation path.
Denial of service in OW2 ASM versions 3.0 through 9.10.x (prior to 9.11) allows an attacker to crash applications that transform untrusted Java class files by supplying a class with a large method containing many long forward jumps, which triggers unbounded recursion in ClassWriter.replaceAsmInstructions() and a StackOverflowError during toByteArray(). The issue is rated moderate severity (CVSS 6.8) and requires the target application to process attacker-controlled bytecode through ClassWriter's transformation path; no public exploit code or active exploitation has been identified, and a vendor patch is available in ASM 9.11. The attack vector is local and requires passive user interaction, with impact limited to availability.
Denial of service in OW2 ASM (versions 3.0 up to but not including 9.11) allows an attacker who can get a crafted Java class file into the library's bytecode parsing pipeline to trigger a roughly 2 GB heap allocation that crashes the JVM. The root cause is that Label.addSubroutineRetSuccessors() fails to enforce ASM's single-RET-per-JSR invariant, so a malformed class file containing multiple RET instructions for one JSR expands the successor set to an enormous size (CWE-789, excessive memory allocation). Impact is availability-only - no code execution or data disclosure - and exploitation requires an application that hands untrusted class files to ASM and reaches the legacy JSR/RET parsing path; the vendor CVSS 4.0 base score is 6.8 (AV:L, UI:P, PR:N), and the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. medium severity and availability-only. No public exploit identified at time of analysis, and there is no evidence of active exploitation.
Denial of service in OW2 ASM 5.0 through 9.10.x allows an attacker who can supply a crafted Java class file to trigger excessive memory allocation while ClassReader parses a BootstrapMethods attribute, causing an OutOfMemoryError that crashes the JVM or the consuming thread. This is a pure availability issue (CVSS 6.8, CWE-789) with no code execution, data disclosure, or integrity impact, and it requires the victim application to parse untrusted bytecode (PR:N, UI:P/UI:R). No public exploit was identified at time of analysis; a vendor patch is available.
Command injection and buffer overflow weaknesses in HPE NonStop Java JToolkit can let a locally positioned, already highly privileged attacker corrupt memory or execute unintended commands within the JToolkit process, with impact limited to low confidentiality, integrity, and availability effects (CVSS 3.1 base 3.8, Low). Exploitation is not remote: it requires pre-existing high local privileges (PR:H), local access to the NonStop system (AV:L), a separate user interaction that supplies attacker-influenced input to the vulnerable routine (UI:R), and additional non-deterministic conditions captured by high attack complexity (AC:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), so all available CVSS signals point to a low real-world priority.
Denial of service in ESA's SLE API for Java (all versions prior to 5.1.7) allows an unauthenticated remote client of the SLE listening service to crash or degrade the service by sending a crafted ISP1 TML/PDU message whose 4-byte big-endian body-length field drives an unbounded byte-array allocation. Because the CVSS vector is PR:N/UI:N and no non-default feature toggle is required, any network-reachable instance in a standard configuration is exposed; however, the practical attacker set is narrowed by the fact that SLE endpoints are typically confined to space-agency ground-segment operational networks rather than the public internet. The flaw is fixed in 5.1.7, and no public exploit code was identified at time of analysis.
Denial of service in the ConnectBot cbssh/sshlib SSH client library (all versions through 0.3.0) lets a malicious or compromised SSH server crash the client process by returning a small malformed packet whose inner length or element-count fields are far larger than the containing packet. The Kaitai Struct Java runtime allocates an array using the attacker-declared length before it notices the input is truncated, producing excessive allocation and an uncaught OutOfMemoryError that terminates the host application; a second, narrower path exists through malformed SSH-agent messages, but only when SSH agent forwarding is enabled. The vulnerable client must initiate a connection to the hostile server (user interaction), which is the main limiting factor; there is no confidentiality or integrity impact, no authentication is required on the general transport path (CVSS 4.0 vector PR:N, UI:A), and no public exploit code was identified at time of analysis. The issue is fixed in version 0.3.1 and is not confirmed as actively exploited (CISA KEV).
Server-side request forgery in Conductor OSS through 3.33.0-rc10 lets remote attackers influence the kafka_request.bootStrapServers argument handled by KafkaPublishTask.start in the Kafka contrib module, causing the Conductor server to connect to an attacker-chosen Kafka bootstrap endpoint. The issue is CWE-918; VulDB rates it CVSS 4.0 5.5, while our independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:L/I:L/A:L and characterizes the practical impact as low, with publicly available exploit code existing but CISA KEV active exploitation not indicated in the provided data. Although the CVSS vector is PR:N, practical exploitation requires that the Kafka contrib module is deployed, that a usable KafkaPublishTask exists, and that the attacker can create or execute a workflow/task controlling the bootstrap-servers argument, so deployments that enforce authentication/authorization on workflow submission or are not internet-exposed are substantially less exposed.
Server-side request forgery in conductor-oss Conductor through 3.33.0-rc10 allows unauthenticated remote attackers to induce the Agentspan Agent Runtime to make crafted requests to arbitrary URLs via AgentController.java (CWE-918). The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) limits impact to confidentiality only, and the CVSS 4.0 vector's E:P metric indicates publicly available exploit code exists; no CISA KEV listing or confirmed active exploitation was provided. Realistic risk is moderate and hinges on whether the Conductor instance is internet-facing and what internal services or cloud metadata endpoints are reachable from the server.
Server-side request forgery in Conductor OSS through 3.32.5 allows unauthenticated remote attackers to force the server to fetch attacker-controlled URLs through the A2A Agent Card Fetching endpoint when the AI/a2a feature is enabled and reachable. The vulnerable path is A2AService.getAgentCard, where the agentUrl argument can be manipulated to reach internal services; publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is indicated. The independent assessment rates this as moderate with low confidentiality, integrity, and availability impact, and exploitation is realistic only where the A2A agent-card functionality is exposed.
Server-side request forgery (CWE-918) in the MCP Service of conductor-oss Conductor 3.22.0 lets an authenticated low-privilege user who can invoke the listTools operation supply a crafted mcpServer argument and cause the Conductor server to issue requests to attacker-chosen destinations. The impact is scored low (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because authentication is required, the vulnerable path is only reachable when the MCP integration is enabled and exposed, and there is no scope change to downstream systems. Publicly available exploit code exists for this issue, but there is no confirmation of active exploitation, and no EPSS or CISA KEV data was provided.
Server-side request forgery in conductor-oss Conductor 3.31.2 allows an authenticated low-privileged user to force the server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted specUrl when defining an API tool, since ListApiToolsTask.start processes that argument without validating or restricting the target address. Successful abuse can expose internal-only services, loopback interfaces, and cloud instance metadata reachable from the Conductor host, with the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:L/A:N) reflecting limited confidentiality and integrity impact and no availability effect. Publicly available exploit code exists and the flaw is disclosed via VulDB; there is no indication of confirmed active exploitation (not in CISA KEV), and exploitation requires a valid low-privileged account that can create or modify API tool definitions plus a network position where internal targets are actually reachable.
Server-side request forgery in Fit2Cloud MeterSphere up to 3.6.9-lts allows an authenticated low-privilege user to make the server issue outbound HTTP requests to an attacker-chosen URL by manipulating the swaggerUrl argument handled by Swagger3ParserApiDefinition.testUrlTimeout in the Swagger3 API-definition import component. Publicly available exploit code exists and the vendor was contacted but did not respond, so no fix is confirmed; the flaw is network-reachable (AV:N) and needs no user interaction, but it requires valid credentials plus access to the API-import feature, which keeps it a moderate priority rather than an urgent one. Real-world impact depends on what the MeterSphere host can reach internally - internal services, admin interfaces, or cloud metadata endpoints - and the assessed impact is limited to low confidentiality exposure (C:L, I:N, A:N).
Open redirect in PublicCMS through 5.202608.a lets unauthenticated remote attackers send users to arbitrary external sites by crafting the returnUrl parameter processed by SafeConfigComponent.getSafeUrl in the pay endpoint. Publicly available exploit code exists, and exploitation requires a victim to follow an attacker-supplied link (social engineering), with impact limited to browser redirection. The vendor was contacted but did not respond, and the independent assessment rates this as a low-priority issue despite remote reachability.
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).
SQL injection in the Autocomplete Handler of erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows remote attackers who already hold a valid low-privilege account to manipulate the trem, searchField, or entityName arguments passed to CommonServiceImpl.getAutoList and execute arbitrary SQL against the backend database, exposing data reachable by that account. Publicly available exploit code exists, so the attack is practical for any user able to authenticate and reach the endpoint; the vector's E:P rating and the reporter's note that the exploit was made public confirm exploitability, though there is no CISA KEV listing indicating confirmed active exploitation. The vendor was contacted early but never responded, and no vendor-released patched version has been identified.
SQL injection in the JEEWMS warehouse management system (erzhongxmu JEEWMS through build 2026.09.27-W39) lets an authenticated low-privilege user execute arbitrary SQL by manipulating the 'searchstr' argument handled by WmInQmIController.list in the Inbound Quality Check PDA interface. The vulnerability is remotely reachable (CVSS:4.0 base 2.1; assessed CVSS:3.1 6.3, AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity and availability impact), so the primary constraint on exploitation is that the attacker needs a valid low-privilege account - it is not exploitable by fully unauthenticated parties. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is currently identified; the issue is not in CISA KEV and real-world priority is low given the authentication prerequisite and the niche deployment footprint of this product.
Authenticated SQL injection in erzhongxmu JEEWMS through version 2026.09.27-W39 allows remote low-privileged users to execute arbitrary SQL via the 'searchstr' parameter in the PDA interface's WmToMoveGoodsController.list endpoint. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (CISA KEV) has been reported. The vendor did not respond to disclosure, and no vendor-released patch has been identified, so risk is moderate and depends on limiting exposure of the PDA interface.
SQL injection in erzhongxmu JEEWMS (versions up to and including 2026.09.27-W39) lets an authenticated low-privileged user inject arbitrary SQL through the 'searchstr' argument of the WmSttInGoodsController.list endpoint, potentially reading, tampering with, or disrupting warehouse-management data. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; there is no confirmed active exploitation (CISA KEV). With an assessed CVSS:4.0 base score of 5.3 and low confidentiality, integrity, and availability impact, this is a moderate-priority issue whose main limiting factor is the authentication prerequisite - anonymous, unauthenticated users cannot reach the vulnerable code path.
SQL injection in the erzhongxmu JEEWMS warehouse management system (versions up to 2026.09.27-W39) allows an authenticated user to inject arbitrary SQL through the 'searchstr' argument processed by the WvGiController.list endpoint, enabling unauthorized reads of database contents and potentially modification or deletion of records. Both the supplied CVSS 4.0 vector (PR:L, E:P) and our independent assessment require a valid low-privilege session before the payload can be delivered, which keeps the rating moderate (CVSS 4.0 base 5.3) and bounds realistic exploitation to insiders or attackers who have already acquired credentials rather than anonymous internet-wide attacks. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix has been published at time of analysis.
SQL injection in erzhongxmu JEEWMS (warehouse management system) through 2026.09.27-W39 lets an authenticated remote user inject arbitrary SQL via the 'searchstr' argument of the notice search endpoint handled by WvNoticeController.list. Publicly available exploit code exists, and the maintainer was contacted early but did not respond, so no vendor-supplied fix has been published; there is no indication of confirmed active exploitation (no CISA KEV entry). Impact is bounded by the privileges of the application's database account (Low confidentiality, integrity, and availability), and exploitation requires a valid low-privileged session (CVSS PR:L).
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows an authenticated remote attacker to inject arbitrary SQL through the binstore, binid, des, or cengshu parameters handled by the getbinall and getbinallagv functions of MdBinController.java, potentially reading or altering database content. The CVSS v4.0 base score is 5.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting low-level confidentiality, integrity, and availability impact rather than full database takeover. A public exploit has been published and may be used, but there is no KEV confirmation of active exploitation; the vendor was contacted and did not respond, so no official fix is documented. Because exploitation requires a valid low-privileged JEEWMS session (PR:L in the assessed vector), risk is concentrated in deployments where the warehouse management interface is network-reachable and credentials are shared or weakly managed.
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) lets an authenticated attacker who supplies a crafted 'goodscode' argument to the docheck handler in WmOmNoticeHController.java manipulate the underlying SQL query. The CVSS v4.0 score is only 2.1 (Low) and our independent re-scoring lands at CVSS 3.1 5.4 (Medium) because exploitation requires a valid low-privileged session (PR:L), yields limited confidentiality and integrity impact, and is confined to one parameter of one controller. Exploit code is publicly available, but there is no CISA KEV entry and no evidence of active exploitation; the vendor was contacted and did not respond, so no official patch is identified. Overall this should be treated as a low-priority hardening item rather than an urgent exposure.
SQL injection in JeeWMS up to and including 3.7 lets an authenticated remote user inject arbitrary HQL through the 'searchVal' parameter of the getTreeData function in JeecgFormDemoController.java, allowing manipulation of the underlying database query. Exploitation requires a valid application session with access to the Autocomplete Data Handler endpoint, which resides in a demo/sample controller (com.jeecg.demo) that may not be exposed in every deployment, so this is a moderate, authentication-gated issue rather than an emergency; no public exploit code has been identified at time of analysis and no EPSS score was provided. The upstream project has published a fix in commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 (PR #4), which switches the vulnerable string concatenation to a parameterized query.
Missing authorization in the JeecgBoot SysPositionController removeUserPosition handler (versions through 3.9.5) allows any authenticated low-privileged user to delete user-to-position mappings in the sys_user_position table by sending DELETE requests with arbitrary userId and positionId values. The attacker gains no confidentiality or code execution, but can silently unbind users from their positions, and the deletions are performed without logging, which hampers detection and attribution. Publicly available exploit code exists (a Python PoC referenced by VulnCheck) and the issue is tracked as CWE-862; no CISA KEV listing indicating confirmed active exploitation was provided. Independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (assessed score consistent with the reported 5.3 base), this is a genuine-but-moderate priority issue requiring a valid authenticated account rather than a critical emergency.
Mall4j through version 4.0 allows any authenticated storefront customer to delete other shoppers' cart entries for off-shelf products by sending a single DELETE request to the /p/shopCart/cleanExpiryProdList endpoint, exploiting an operator precedence error in the cleanExpiryProdList SQL statement that fails to scope the deletion to the caller. This improper authorization flaw (CWE-783) has a CVSS 4.0 score of 5.3 with low integrity and availability impact and no confidentiality impact (PR:L), and publicly available exploit code exists. It is not listed in CISA KEV, and no active exploitation has been confirmed.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated, low-privileged user send spoofed template announcements by POSTing to /sys/api/sendTemplateAnnouncement with attacker-chosen sender, recipient, title, and template parameters, so the resulting messages appear to come from admin or system accounts. Rated 5.3 (medium), the issue carries only low integrity impact with no confidentiality or availability effect and no path to code execution, and it requires the attacker to already hold a valid JeecgBoot session. Publicly available exploit code exists (VulnCheck-reported POC plus a GitHub PoC script), though there is no indication of confirmed active exploitation.
Missing authorization in JeecgBoot (all versions through 3.9.5) lets any authenticated, low-privileged user alter tenant administrator application status for arbitrary tenants by sending a PUT request to /sys/tenant/updateApplyStatus with a tenant id they do not own. The endpoint performs no ownership or role check on the supplied identifier, so an ordinary account - including one obtained through self-registration - can toggle the applyStatus field and thereby enable or disable tenant-admin applications across the entire instance. Publicly available exploit code exists (a Python PoC is published in a public GitHub repository), though this is not confirmed as actively exploited in the wild; EPSS and KEV data were not provided, and the independent assessment rates this as a moderate-severity broken access control issue with limited blast radius, since impact is confined to status toggling rather than full tenant takeover.
Authenticated low-privileged users can delete department permission bindings in JeecgBoot through 3.9.5 by calling the SysDepartPermissionController delete handler, which performs no authorization check (CWE-862). Because the corresponding list endpoint is also unguarded, an attacker can enumerate the required row ids and then issue DELETE requests that strip menu and button grants from department roles, degrading the instance's RBAC configuration. Publicly available exploit code exists, and the flaw affects default deployments, but the impact is bounded to integrity/availability of permission data - no data disclosure and no privilege escalation beyond RBAC degradation - which is why the vendor score is a moderate 5.3.
Any authenticated JeecgBoot user - regardless of privilege level - can add, modify or clear department data-rule bindings by POSTing departId, permissionId and dataRuleIds to /sys/sysDepartPermission/datarule, because the saveDatarule handler in SysDepartPermissionController performs no authorization check, in versions through 3.9.5. Publicly available exploit code exists, but no active exploitation is confirmed (not in CISA KEV). With a CVSS 5.3 rating reflecting network reachability, low privileges required and only low integrity impact, realistic risk concentrates in multi-department or multi-tenant deployments where untrusted low-privilege accounts exist.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user read role data-rule metadata - rule names, columns, conditions, values and bound rule IDs - for arbitrary roles via GET /sys/role/datarule/{permissionId}/{roleId}. The loadDatarule handler in SysRoleController omits the authorization check that its sibling endpoints enforce, so a low-privileged account (PR:L, unauthenticated access does not work) can enumerate permissionId/roleId pairs and exfiltrate the row-level access-control policy of the whole tenant. Impact is information disclosure only (CWE-862, no write, no code execution); publicly available exploit code exists, and the CVE is not in CISA KEV.
Missing authorization in the JeecgBoot SysPositionController edit handler (/sys/position/edit) lets any authenticated low-privileged account rewrite organizational position names, codes, and ranks via crafted PUT or POST requests, affecting JeecgBoot through 3.9.5. Because the position list endpoint is also unguarded, an attacker can first enumerate valid position IDs and then target them directly, so no guesswork or elevated role is required. Impact is confined to the integrity of position reference data - there is no confidentiality or availability loss and no escalation to system compromise - and the issue is correctly rated medium (CVSS 5.3); publicly available exploit code exists, while no CISA KEV active-exploitation entry is indicated.
Any authenticated user, including low-privileged accounts, can delete organizational positions in JeecgBoot 3.9.5 and earlier by exploiting a missing authorization check in the SysPositionController deleteBatch handler. Attackers harvest valid position IDs from an unguarded list endpoint and submit them as a comma-separated list, destroying sys_position records and orphaning user-position assignments. This is a moderate-severity data-destruction issue, reflected by the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; publicly available exploit code exists, but no active exploitation is confirmed in CISA KEV.
Heap memory corruption in Apache DataSketches C++ (datasketches-cpp) versions 4.1.0 through 5.2.0 allows remote attackers to trigger out-of-bounds reads and writes via a crafted Count-Min sketch submitted to the deserialize() function. The flaw combines a missing preamble size check that permits up to 16 bytes over-read on truncated input, and a 32-bit integer overflow in the serialized bucket count that can wrap to zero, resulting in an empty table and subsequent heap memory corruption during updates or estimate queries. Exploitation requires an application to deserialize Count-Min sketches from untrusted sources; no public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the severity as moderate.
Double-release of pooled decompression buffers in Xerial snappy-java 1.1.7.4 through 1.1.10.9 lets a crafted Snappy framed stream corrupt or expose data belonging to another, concurrently active stream. An attacker-supplied frame that declares an oversized chunk length forces the replacement buffer allocation to fail with OutOfMemoryError, after which the failed path still treats the already-released pooled buffer as live and returns it to the pool a second time, so the same backing array can be handed to a second stream. The flaw is remote and unauthenticated (CVSS:4.0 vector PR:N) but opportunistic rather than deterministic, requires the target to decompress untrusted framed input through SnappyFramedInputStream while drawing from a shared buffer pool, and carries no public exploit identified at time of analysis; overall risk is medium severity rather than urgent emergency.