{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:23:59.585Z", "tag": { "id": "java", "label": "Java", "isStack": true, "url": "https://pwn.watch/t/java", "feed": "https://pwn.watch/t/java/feed.xml" }, "counts": { "incidents": 31, "live": 0, "notFullyPatched": 0, "patched": 31 }, "incidents": [ { "slug": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962", "title": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability", "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962", "json": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in", "tags": [ "java", "oracle", "weblogic", "cisa-kev" ], "cveIds": [ "CVE-2026-21962" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-24", "closedAt": "2026-08-24", "updatedAt": "2026-08-24", "summary": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.", "xPost": null }, { "slug": "apache-tomcat-cve-2026-34486", "title": "Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability", "url": "https://pwn.watch/i/apache-tomcat-cve-2026-34486", "json": "https://pwn.watch/i/apache-tomcat-cve-2026-34486.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache Tomcat", "tags": [ "java", "apache", "tomcat", "cisa-kev" ], "cveIds": [ "CVE-2026-34486" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-04", "closedAt": "2026-08-04", "updatedAt": "2026-08-04", "summary": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04.", "xPost": null }, { "slug": "apache-activemq-cve-2026-34197", "title": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197", "json": "https://pwn.watch/i/apache-activemq-cve-2026-34197.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache ActiveMQ", "tags": [ "java", "apache", "activemq", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-34197" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-16", "closedAt": "2026-04-16", "updatedAt": "2026-04-16", "summary": "Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.", "xPost": null }, { "slug": "osgeo-geoserver-cve-2025-58360", "title": "OSGeo GeoServer: GeoServer Improper Restriction of XML External Entity Reference Vulnerability", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2025-58360", "json": "https://pwn.watch/i/osgeo-geoserver-cve-2025-58360.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "OSGeo GeoServer", "tags": [ "java", "geoserver", "cisa-kev" ], "cveIds": [ "CVE-2025-58360" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-12-11", "closedAt": "2025-12-11", "updatedAt": "2025-12-11", "summary": "OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. Added to CISA KEV on 2025-12-11.", "xPost": null }, { "slug": "xwiki-platform-cve-2025-24893", "title": "XWiki Platform: Platform Eval Injection Vulnerability", "url": "https://pwn.watch/i/xwiki-platform-cve-2025-24893", "json": "https://pwn.watch/i/xwiki-platform-cve-2025-24893.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "XWiki Platform", "tags": [ "java", "xwiki", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-24893" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-30", "closedAt": "2025-10-30", "updatedAt": "2025-10-30", "summary": "XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch. Added to CISA KEV on 2025-10-30.", "xPost": null }, { "slug": "jenkins-cve-2017-1000353", "title": "Jenkins: Remote Code Execution Vulnerability", "url": "https://pwn.watch/i/jenkins-cve-2017-1000353", "json": "https://pwn.watch/i/jenkins-cve-2017-1000353.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Jenkins", "tags": [ "java", "devtools", "jenkins", "cisa-kev", "rce" ], "cveIds": [ "CVE-2017-1000353" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-02", "closedAt": "2025-10-02", "updatedAt": "2025-10-02", "summary": "Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. Added to CISA KEV on 2025-10-02.", "xPost": null }, { "slug": "apache-tomcat-cve-2025-24813", "title": "Apache Tomcat: Tomcat Path Equivalence Vulnerability", "url": "https://pwn.watch/i/apache-tomcat-cve-2025-24813", "json": "https://pwn.watch/i/apache-tomcat-cve-2025-24813.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache Tomcat", "tags": [ "java", "apache", "tomcat", "cisa-kev" ], "cveIds": [ "CVE-2025-24813" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-01", "closedAt": "2025-04-01", "updatedAt": "2025-04-01", "summary": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. Added to CISA KEV on 2025-04-01.", "xPost": null }, { "slug": "apache-ofbiz-cve-2024-45195", "title": "Apache OFBiz: OFBiz Forced Browsing Vulnerability", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-45195", "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-45195.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache OFBiz", "tags": [ "java", "apache", "cisa-kev" ], "cveIds": [ "CVE-2024-45195" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-04", "closedAt": "2025-02-04", "updatedAt": "2025-02-04", "summary": "Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. Added to CISA KEV on 2025-02-04.", "xPost": null }, { "slug": "oracle-weblogic-server-cve-2020-2883", "title": "Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883", "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle WebLogic Server", "tags": [ "java", "oracle", "weblogic", "cisa-kev" ], "cveIds": [ "CVE-2020-2883" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-07", "closedAt": "2025-01-07", "updatedAt": "2025-01-07", "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. Added to CISA KEV on 2025-01-07.", "xPost": null }, { "slug": "atlassian-jira-server-and-data-center-cve-2021-26086", "title": "Atlassian Jira Server and Data Center Path Traversal", "url": "https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086", "json": "https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Atlassian Jira Server and Data Center", "tags": [ "java", "atlassian", "jira", "cisa-kev" ], "cveIds": [ "CVE-2021-26086" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-12", "closedAt": "2024-11-12", "updatedAt": "2024-11-12", "summary": "Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-26086 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "oracle-adf-faces-cve-2022-21445", "title": "Oracle ADF Faces Deserialization of Untrusted Data", "url": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445", "json": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle ADF Faces", "tags": [ "java", "oracle", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-21445" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2022-21445 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "oracle-weblogic-server-cve-2020-14644", "title": "Oracle WebLogic Server Remote Code Execution", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644", "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle WebLogic Server", "tags": [ "java", "oracle", "weblogic", "cisa-kev", "rce" ], "cveIds": [ "CVE-2020-14644" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "apache-ofbiz-cve-2024-38856", "title": "Apache OFBiz Incorrect Authorization", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856", "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache OFBiz", "tags": [ "java", "apache", "ofbiz", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-38856" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-05", "closedAt": "2024-08-27", "updatedAt": "2024-08-27", "summary": "Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Added to the CISA KEV catalog on 2024-08-27.", "xPost": null }, { "slug": "osgeo-geoserver-cve-2024-36401", "title": "OSGeo GeoServer GeoTools Eval Injection", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401", "json": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "OSGeo GeoServer", "tags": [ "java", "osgeo", "geoserver", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-36401" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-01", "closedAt": "2024-07-15", "updatedAt": "2024-07-15", "summary": "OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.", "xPost": null }, { "slug": "osgeo-jai-ext-cve-2022-24816", "title": "OSGeo GeoServer JAI-EXT Code Injection", "url": "https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816", "json": "https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "OSGeo JAI-EXT", "tags": [ "java", "osgeo", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-24816" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-26", "closedAt": "2024-06-26", "updatedAt": "2024-06-26", "summary": "OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-24816 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "oracle-weblogic-server-cve-2017-3506", "title": "Oracle WebLogic Server OS Command Injection", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506", "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Oracle WebLogic Server", "tags": [ "java", "oracle", "weblogic", "cisa-kev", "rce" ], "cveIds": [ "CVE-2017-3506" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-03", "closedAt": "2024-06-03", "updatedAt": "2024-06-03", "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "apache-flink-cve-2020-17519", "title": "Apache Flink Improper Access Control", "url": "https://pwn.watch/i/apache-flink-cve-2020-17519", "json": "https://pwn.watch/i/apache-flink-cve-2020-17519.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache Flink", "tags": [ "java", "apache", "flink", "cisa-kev" ], "cveIds": [ "CVE-2020-17519" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-23", "closedAt": "2024-05-23", "updatedAt": "2024-05-23", "summary": "Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Added to the CISA KEV catalog on 2024-05-23. CVE-2020-17519 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "nextgen-healthcare-mirth-connect-cve-2023-43208", "title": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data", "url": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208", "json": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "NextGen Healthcare Mirth Connect", "tags": [ "java", "nextgen-healthcare", "mirth-connect", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-43208" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-20", "closedAt": "2024-05-20", "updatedAt": "2024-05-20", "summary": "NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. Added to the CISA KEV catalog on 2024-05-20. CISA lists known use in ransomware campaigns. CVE-2023-43208 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "apache-ofbiz-cve-2024-32113", "title": "Apache OFBiz Path Traversal", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113", "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache OFBiz", "tags": [ "java", "apache", "ofbiz", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-32113" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-08", "closedAt": "2024-08-07", "updatedAt": "2024-08-07", "summary": "Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-07.", "xPost": null }, { "slug": "apache-hugegraph-server-cve-2024-27348", "title": "Apache HugeGraph-Server Improper Access Control", "url": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348", "json": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache HugeGraph-Server", "tags": [ "java", "apache", "hugegraph", "cisa-kev" ], "cveIds": [ "CVE-2024-27348" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-04-22", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.", "xPost": null }, { "slug": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "title": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "JetBrains TeamCity", "tags": [ "devtools", "java", "jetbrains", "teamcity", "auth-bypass", "ci-cd", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-27198", "CVE-2024-27199" ], "affectedVersions": [ "TeamCity On-Premises before 2023.11.4 (JetBrains)" ], "fixedVersions": [ "2023.11.4 (JetBrains)" ], "startedAt": "2024-03-04", "closedAt": "2024-03-07", "updatedAt": "2024-03-07", "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "title": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897", "json": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Jenkins Command Line Interface (CLI)", "tags": [ "devtools", "java", "jenkins", "ci-cd", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-23897" ], "affectedVersions": [ "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (Jenkins advisory)" ], "fixedVersions": [ "Jenkins 2.442", "LTS 2.426.3", "LTS 2.440.1" ], "startedAt": "2024-01-24", "closedAt": "2024-08-19", "updatedAt": "2024-08-19", "summary": "Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "atlassian-confluence-data-center-and-server-cve-2023-22527", "title": "Atlassian Confluence Data Center and Server Template Injection", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527", "json": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-22527" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-16", "closedAt": "2024-01-24", "updatedAt": "2024-01-24", "summary": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "atlassian-confluence-improper-authorization-cve-2023-22518", "title": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518", "json": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "auth-bypass", "ransomware", "cerber", "cisa-kev" ], "cveIds": [ "CVE-2023-22518" ], "affectedVersions": [ "All versions of Confluence Data Center and Server before the fixed releases (NVD)" ], "fixedVersions": [ "7.19.16", "8.3.4", "8.4.4", "8.5.3", "8.6.1" ], "startedAt": "2023-10-31", "closedAt": "2023-11-07", "updatedAt": "2023-11-07", "summary": "An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.", "xPost": null }, { "slug": "apache-activemq-openwire-rce-cve-2023-46604", "title": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604", "json": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache ActiveMQ (Java OpenWire brokers and clients)", "tags": [ "java", "apache", "activemq", "rce", "deserialization", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-46604" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "5.15.16", "5.16.7", "5.17.6", "5.18.3" ], "startedAt": "2023-10-27", "closedAt": "2023-11-02", "updatedAt": "2023-11-02", "summary": "A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.", "xPost": null }, { "slug": "atlassian-confluence-admin-creation-cve-2023-22515", "title": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515", "json": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "zero-day", "auth-bypass", "china", "cisa-kev" ], "cveIds": [ "CVE-2023-22515" ], "affectedVersions": [ "8.0.0 to 8.5.1 (Atlassian advisory)" ], "fixedVersions": [ "8.3.3", "8.4.3", "8.5.2 (LTS)" ], "startedAt": "2023-10-04", "closedAt": "2023-10-16", "updatedAt": "2023-10-16", "summary": "A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.", "xPost": null }, { "slug": "apache-rocketmq-cve-2023-33246", "title": "Apache RocketMQ: Command Execution (CVE-2023-33246)", "url": "https://pwn.watch/i/apache-rocketmq-cve-2023-33246", "json": "https://pwn.watch/i/apache-rocketmq-cve-2023-33246.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache RocketMQ", "tags": [ "java", "apache", "cisa-kev" ], "cveIds": [ "CVE-2023-33246" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-09-06", "closedAt": "2023-09-06", "updatedAt": "2023-09-06", "summary": "Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. Added to CISA KEV on 2023-09-06.", "xPost": null }, { "slug": "http2-rapid-reset-ddos-cve-2023-44487", "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)", "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487", "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)", "tags": [ "node", "go", "java", "dotnet", "http2", "ddos", "cloudflare", "google", "aws", "nginx", "cisa-kev" ], "cveIds": [ "CVE-2023-44487" ], "affectedVersions": [ "Most HTTP/2 implementations; see each vendor's advisory" ], "fixedVersions": [ "See vendor advisories (each HTTP/2 implementation shipped its own fix)" ], "startedAt": "2023-08-25", "closedAt": "2023-10-10", "updatedAt": "2023-10-10", "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.", "xPost": null }, { "slug": "oracle-weblogic-server-cve-2023-21839", "title": "Oracle WebLogic Server: Unspecified (CVE-2023-21839)", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839", "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Oracle WebLogic Server", "tags": [ "java", "oracle", "weblogic", "cisa-kev" ], "cveIds": [ "CVE-2023-21839" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-05-01", "closedAt": "2023-05-01", "updatedAt": "2023-05-01", "summary": "Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. Added to CISA KEV on 2023-05-01.", "xPost": null }, { "slug": "apache-spark-cve-2022-33891", "title": "Apache Spark: Command Injection (CVE-2022-33891)", "url": "https://pwn.watch/i/apache-spark-cve-2022-33891", "json": "https://pwn.watch/i/apache-spark-cve-2022-33891.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache Spark", "tags": [ "java", "apache", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-33891" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-07", "closedAt": "2023-03-07", "updatedAt": "2023-03-07", "summary": "Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. Added to CISA KEV on 2023-03-07.", "xPost": null }, { "slug": "zk-framework-auuploader-cve-2022-36537", "title": "ZK Framework AuUploader: Unspecified (CVE-2022-36537)", "url": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537", "json": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ZK Framework AuUploader", "tags": [ "java", "zk-framework", "connectwise", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2022-36537" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-27", "closedAt": "2023-02-27", "updatedAt": "2023-02-27", "summary": "ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. Added to CISA KEV on 2023-02-27. CISA lists known use in ransomware campaigns.", "xPost": null } ], "posts": [], "changes": [ { "incident": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962", "incidentTitle": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-24", "title": "CISA added CVE-2026-21962 to the KEV catalog (due 2026-08-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962" }, { "incident": "apache-tomcat-cve-2026-34486", "incidentTitle": "Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-34486 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-tomcat-cve-2026-34486" }, { "incident": "apache-activemq-cve-2026-34197", "incidentTitle": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-16", "title": "CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197" }, { "incident": "osgeo-geoserver-cve-2025-58360", "incidentTitle": "OSGeo GeoServer: GeoServer Improper Restriction of XML External Entity Reference Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-12-11", "title": "CISA added CVE-2025-58360 to the KEV catalog (due 2026-01-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/osgeo-geoserver-cve-2025-58360" }, { "incident": "xwiki-platform-cve-2025-24893", "incidentTitle": "XWiki Platform: Platform Eval Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-30", "title": "CISA added CVE-2025-24893 to the KEV catalog (due 2025-11-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/xwiki-platform-cve-2025-24893" }, { "incident": "jenkins-cve-2017-1000353", "incidentTitle": "Jenkins: Remote Code Execution Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-02", "title": "CISA added CVE-2017-1000353 to the KEV catalog (due 2025-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jenkins-cve-2017-1000353" }, { "incident": "apache-tomcat-cve-2025-24813", "incidentTitle": "Apache Tomcat: Tomcat Path Equivalence Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-01", "title": "CISA added CVE-2025-24813 to the KEV catalog (due 2025-04-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-tomcat-cve-2025-24813" }, { "incident": "apache-ofbiz-cve-2024-45195", "incidentTitle": "Apache OFBiz: OFBiz Forced Browsing Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-04", "title": "CISA added CVE-2024-45195 to the KEV catalog (due 2025-02-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-45195" }, { "incident": "oracle-weblogic-server-cve-2020-2883", "incidentTitle": "Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-07", "title": "CISA added CVE-2020-2883 to the KEV catalog (due 2025-01-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883" }, { "incident": "atlassian-jira-server-and-data-center-cve-2021-26086", "incidentTitle": "Atlassian Jira Server and Data Center Path Traversal", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2021-26086 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086" }, { "incident": "oracle-adf-faces-cve-2022-21445", "incidentTitle": "Oracle ADF Faces Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2022-21445 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445" }, { "incident": "oracle-weblogic-server-cve-2020-14644", "incidentTitle": "Oracle WebLogic Server Remote Code Execution", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2020-14644 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644" }, { "incident": "apache-hugegraph-server-cve-2024-27348", "incidentTitle": "Apache HugeGraph-Server Improper Access Control", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2024-27348 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348" }, { "incident": "apache-ofbiz-cve-2024-38856", "incidentTitle": "Apache OFBiz Incorrect Authorization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-27", "title": "CISA added CVE-2024-38856 to the KEV catalog (federal deadline 2024-09-17)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-19", "title": "CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "apache-ofbiz-cve-2024-32113", "incidentTitle": "Apache OFBiz Path Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-07", "title": "CISA added CVE-2024-32113 to the KEV catalog (federal deadline 2024-08-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113" }, { "incident": "apache-ofbiz-cve-2024-38856", "incidentTitle": "Apache OFBiz Incorrect Authorization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-05", "title": "CVE-2024-38856 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38856", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856" }, { "incident": "osgeo-geoserver-cve-2024-36401", "incidentTitle": "OSGeo GeoServer GeoTools Eval Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-15", "title": "CISA added CVE-2024-36401 to the KEV catalog (federal deadline 2024-08-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401" }, { "incident": "osgeo-geoserver-cve-2024-36401", "incidentTitle": "OSGeo GeoServer GeoTools Eval Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-01", "title": "CVE-2024-36401 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-36401", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401" }, { "incident": "osgeo-jai-ext-cve-2022-24816", "incidentTitle": "OSGeo GeoServer JAI-EXT Code Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-26", "title": "CISA added CVE-2022-24816 to the KEV catalog (federal deadline 2024-07-17)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816" }, { "incident": "oracle-weblogic-server-cve-2017-3506", "incidentTitle": "Oracle WebLogic Server OS Command Injection", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-03", "title": "CISA added CVE-2017-3506 to the KEV catalog (federal deadline 2024-06-24)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506" }, { "incident": "apache-flink-cve-2020-17519", "incidentTitle": "Apache Flink Improper Access Control", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-23", "title": "CISA added CVE-2020-17519 to the KEV catalog (federal deadline 2024-06-13)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-flink-cve-2020-17519" }, { "incident": "nextgen-healthcare-mirth-connect-cve-2023-43208", "incidentTitle": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-20", "title": "CISA added CVE-2023-43208 to the KEV catalog (federal deadline 2024-06-10)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208" }, { "incident": "apache-ofbiz-cve-2024-32113", "incidentTitle": "Apache OFBiz Path Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-08", "title": "CVE-2024-32113 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-32113", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113" }, { "incident": "apache-hugegraph-server-cve-2024-27348", "incidentTitle": "Apache HugeGraph-Server Improper Access Control", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-22", "title": "CVE-2024-27348 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27348", "url": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-07", "title": "CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CVE-2024-27198 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27198", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CVE-2024-27199 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27199", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses", "body": null, "sourceUrl": "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "CVE-2024-23897 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "Jenkins security advisory and fixed releases", "body": null, "sourceUrl": "https://www.jenkins.io/security/advisory/2024-01-24/", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527", "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "CISA added CVE-2023-22527 to the KEV catalog (federal deadline 2024-02-14)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527" }, { "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527", "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-16", "title": "CVE-2023-22527 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-22527", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-07", "title": "CISA adds CVE-2023-22518 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-06", "title": "Atlassian raises the CVSS score to 10 after active exploitation and Cerber ransomware deployments", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-02", "title": "CISA adds CVE-2023-46604 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-01", "title": "Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware", "body": null, "sourceUrl": "https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "Atlassian discloses CVE-2023-22518 and ships fixes", "body": null, "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-27", "title": "Apache publishes the CVE-2023-46604 announcement; fixed releases already out", "body": null, "sourceUrl": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "http2-rapid-reset-ddos-cve-2023-44487", "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-10", "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV", "body": null, "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack", "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-05", "title": "CISA adds CVE-2023-22515 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "Atlassian discloses the zero-day after customer reports and ships fixes", "body": null, "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "apache-rocketmq-cve-2023-33246", "incidentTitle": "Apache RocketMQ: Command Execution (CVE-2023-33246)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-06", "title": "CISA added CVE-2023-33246 to the KEV catalog (due 2023-09-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-rocketmq-cve-2023-33246" }, { "incident": "http2-rapid-reset-ddos-cve-2023-44487", "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-25", "title": "Cloudflare starts seeing unusually large HTTP/2 attacks", "body": null, "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/", "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487" }, { "incident": "oracle-weblogic-server-cve-2023-21839", "incidentTitle": "Oracle WebLogic Server: Unspecified (CVE-2023-21839)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-05-01", "title": "CISA added CVE-2023-21839 to the KEV catalog (due 2023-05-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839" }, { "incident": "apache-spark-cve-2022-33891", "incidentTitle": "Apache Spark: Command Injection (CVE-2022-33891)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-03-07", "title": "CISA added CVE-2022-33891 to the KEV catalog (due 2023-03-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-spark-cve-2022-33891" }, { "incident": "zk-framework-auuploader-cve-2022-36537", "incidentTitle": "ZK Framework AuUploader: Unspecified (CVE-2022-36537)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-27", "title": "CISA added CVE-2022-36537 to the KEV catalog (due 2023-03-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537" } ] }