# Java security incidents · pwn.watch

> Security incidents affecting Java runtimes and app servers (Tomcat, WebLogic, ActiveMQ).

Page: https://pwn.watch/t/java · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 31 (0 live, 0 live and not fully patched, 31 patched)
- Days without a Java security incident: 59
- Newest incident started: 2026-08-24

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/java.json
- RSS (every update): https://pwn.watch/t/java/feed.xml
- This file: https://pwn.watch/t/java/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability](https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962) ([json](https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962.json)): high, closed, patched, started 2026-08-24, CVE-2026-21962
- [Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability](https://pwn.watch/i/apache-tomcat-cve-2026-34486) ([json](https://pwn.watch/i/apache-tomcat-cve-2026-34486.json)): high, closed, patched, started 2026-08-04, CVE-2026-34486
- [Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability](https://pwn.watch/i/apache-activemq-cve-2026-34197) ([json](https://pwn.watch/i/apache-activemq-cve-2026-34197.json)): high, closed, patched, started 2026-04-16, CVE-2026-34197
- [OSGeo GeoServer: GeoServer Improper Restriction of XML External Entity Reference Vulnerability](https://pwn.watch/i/osgeo-geoserver-cve-2025-58360) ([json](https://pwn.watch/i/osgeo-geoserver-cve-2025-58360.json)): high, closed, patched, started 2025-12-11, CVE-2025-58360
- [XWiki Platform: Platform Eval Injection Vulnerability](https://pwn.watch/i/xwiki-platform-cve-2025-24893) ([json](https://pwn.watch/i/xwiki-platform-cve-2025-24893.json)): critical, closed, patched, started 2025-10-30, CVE-2025-24893
- [Jenkins: Remote Code Execution Vulnerability](https://pwn.watch/i/jenkins-cve-2017-1000353) ([json](https://pwn.watch/i/jenkins-cve-2017-1000353.json)): critical, closed, patched, started 2025-10-02, CVE-2017-1000353
- [Apache Tomcat: Tomcat Path Equivalence Vulnerability](https://pwn.watch/i/apache-tomcat-cve-2025-24813) ([json](https://pwn.watch/i/apache-tomcat-cve-2025-24813.json)): critical, closed, patched, started 2025-04-01, CVE-2025-24813
- [Apache OFBiz: OFBiz Forced Browsing Vulnerability](https://pwn.watch/i/apache-ofbiz-cve-2024-45195) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-45195.json)): critical, closed, patched, started 2025-02-04, CVE-2024-45195
- [Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability](https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883) ([json](https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883.json)): critical, closed, patched, started 2025-01-07, CVE-2020-2883
- [Atlassian Jira Server and Data Center Path Traversal](https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086) ([json](https://pwn.watch/i/atlassian-jira-server-and-data-center-cve-2021-26086.json)): medium, closed, patched, started 2024-11-12, CVE-2021-26086
- [Oracle ADF Faces Deserialization of Untrusted Data](https://pwn.watch/i/oracle-adf-faces-cve-2022-21445) ([json](https://pwn.watch/i/oracle-adf-faces-cve-2022-21445.json)): critical, closed, patched, started 2024-09-18, CVE-2022-21445
- [Oracle WebLogic Server Remote Code Execution](https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644) ([json](https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644.json)): critical, closed, patched, started 2024-09-18, CVE-2020-14644
- [Apache OFBiz Incorrect Authorization](https://pwn.watch/i/apache-ofbiz-cve-2024-38856) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-38856.json)): high, closed, patched, started 2024-08-05, CVE-2024-38856
- [OSGeo GeoServer GeoTools Eval Injection](https://pwn.watch/i/osgeo-geoserver-cve-2024-36401) ([json](https://pwn.watch/i/osgeo-geoserver-cve-2024-36401.json)): critical, closed, patched, started 2024-07-01, CVE-2024-36401
- [OSGeo GeoServer JAI-EXT Code Injection](https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816) ([json](https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816.json)): critical, closed, patched, started 2024-06-26, CVE-2022-24816
- [Oracle WebLogic Server OS Command Injection](https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506) ([json](https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506.json)): high, closed, patched, started 2024-06-03, CVE-2017-3506
- [Apache Flink Improper Access Control](https://pwn.watch/i/apache-flink-cve-2020-17519) ([json](https://pwn.watch/i/apache-flink-cve-2020-17519.json)): critical, closed, patched, started 2024-05-23, CVE-2020-17519
- [NextGen Healthcare Mirth Connect Deserialization of Untrusted Data](https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208) ([json](https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json)): critical, closed, patched, started 2024-05-20, CVE-2023-43208
- [Apache OFBiz Path Traversal](https://pwn.watch/i/apache-ofbiz-cve-2024-32113) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-32113.json)): critical, closed, patched, started 2024-05-08, CVE-2024-32113
- [Apache HugeGraph-Server Improper Access Control](https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348) ([json](https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348.json)): critical, closed, patched, started 2024-04-22, CVE-2024-27348
- [JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json)): critical, closed, patched, started 2024-03-04, CVE-2024-27198, CVE-2024-27199
- [Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897) ([json](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json)): critical, closed, patched, started 2024-01-24, CVE-2024-23897
- [Atlassian Confluence Data Center and Server Template Injection](https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527) ([json](https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json)): critical, closed, patched, started 2024-01-16, CVE-2023-22527
- [Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)](https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518) ([json](https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json)): critical, closed, patched, started 2023-10-31, CVE-2023-22518
- [Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604) ([json](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json)): critical, closed, patched, started 2023-10-27, CVE-2023-46604
- [Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)](https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515) ([json](https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json)): critical, closed, patched, started 2023-10-04, CVE-2023-22515
- [Apache RocketMQ: Command Execution (CVE-2023-33246)](https://pwn.watch/i/apache-rocketmq-cve-2023-33246) ([json](https://pwn.watch/i/apache-rocketmq-cve-2023-33246.json)): critical, closed, patched, started 2023-09-06, CVE-2023-33246
- [HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)](https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487) ([json](https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json)): high, closed, patched, started 2023-08-25, CVE-2023-44487
- [Oracle WebLogic Server: Unspecified (CVE-2023-21839)](https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839) ([json](https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839.json)): high, closed, patched, started 2023-05-01, CVE-2023-21839
- [Apache Spark: Command Injection (CVE-2022-33891)](https://pwn.watch/i/apache-spark-cve-2022-33891) ([json](https://pwn.watch/i/apache-spark-cve-2022-33891.json)): high, closed, patched, started 2023-03-07, CVE-2022-33891
- [ZK Framework AuUploader: Unspecified (CVE-2022-36537)](https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537) ([json](https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537.json)): high, closed, patched, started 2023-02-27, CVE-2022-36537