v.26.4.2314

Configuration

This page lists 403 vulnerabilities in this category.

Critical: 4 High: 127 Medium: 173 Low: 51 Information: 48

Vulnerability Name

CVE

CWE

Severity

Lucee Unset Admin Password

CWE-200

Critical

ASP.NET ViewState Weak Validation Key

CWE-321

Critical

Kentico Staging API Authentication Bypass

CVE-2025-2746

CWE-287

Critical

Unrestricted access to Apache HugeGraph

CWE-200

Critical

Adobe Experience Manager Misconfiguration

CVE-2016-0957

CWE-693

High

XML external entity injection via File Upload

CWE-611

High

XML external entity injection (variant)

CWE-611

High

Elmah.axd / Errorlog.axd Detected

CWE-209

High

Nginx PHP code execution via FastCGI

CWE-94

High

Insecure Transportation Security Protocol Supported (TLS 1.0)

CWE-326

High

Joomla! Core Security Bypass

CVE-2017-11364

High

Atlassian Jira insecure REST permissions

High

Web Cache Poisoning

CWE-44

High

Trace.axd Detected

CWE-215

High

CouchDB REST API publicly accessible

CWE-285

High

Hadoop YARN ResourceManager publicly accessible

CWE-200

High

XML external entity injection

CWE-611

High

Jupyter Notebook publicly accessible

CWE-78

High

OSGi Management Console Default Credentials

CWE-521

High

Xdebug remote code execution via xdebug.remote_connect_back

CWE-200

High

BottlePy weak secret key

CWE-693

High

JWT Signature Bypass via None Algorithm

CWE-345

High

Weak Secret is Used to Sign JWT

CWE-347

High

Oracle PeopleSoft SSO weak secret key

CWE-693

High

XML External Entity Injection via external file

CWE-611

High

Padding oracle attack

CWE-209

High

XML external entity injection and XML injection

CWE-611

High

Apache Tomcat insecure default administrative password

CVE-2009-3548

CWE-798

High

Reachable SharePoint interface

CWE-200

High

SharePoint user enumeration

CWE-200

High

Struts 2 development mode

CWE-489

High

Elasticsearch service accessible

CWE-200

High

Roundcube security updates 0.8.6 and 0.7.3

CVE-2013-1904

CWE-22

High

CodeIgniter weak encryption key

CWE-200

High

Ruby on Rails weak/known secret token

CVE-2013-0156

CWE-200

High

Apache Geronimo default administrative credentials

CWE-693

High

JBoss BSHDeployer MBean

CWE-200

High

XML entity injection

CWE-611

High

JBoss HttpAdaptor JMXInvokerServlet

CWE-94

High

JBoss JMX management console

CWE-200

High

JBoss ServerInfo MBean

CVE-2010-0738

CWE-200

High

JBoss Server MBean

CWE-200

High

JBoss JMX Console Unrestricted Access

CWE-200

High

JBoss Web Console JMX Invoker

CWE-200

High

Unprotected phpMyAdmin interface

CWE-205

High

Apache solr service exposed

CWE-200

High

SAP Management Console list logfiles

CWE-200

High

Ruby framework weak secret key

CWE-693

High

Apache REST RCE CVE-2018-11770

CVE-2018-11770

CWE-94

High

SAP Management Console get user list

CWE-200

High

TorchServe Management API publicly exposed

CVE-2023-43654

CWE-200

High

qdPM Information Disclosure

CWE-260

High

Virtual Host locations misconfiguration

CWE-200

High

ASP.NET connection strings stored in plaintext

CWE-312

High

Jenkins Git Plugin missing permission check (CVE-2022-36883)

CVE-2022-36883

CWE-862

High

Pentaho API Auth bypass (CVE-2021-31602)

CVE-2021-31602

CWE-863

High

Struts2 Development Mode Enabled

CWE-489

High

Weak WordPress security key

CWE-326

High

Consul API publicly exposed

CWE-200

High

Case-Insensitive Routing Bypass in Express.js Application

CWE-287

High

Node.js Inspector Unauthorized Access Vulnerability

CWE-200

High

Web Cache Deception

High

Harbor Unauthorized Access Vulnerability

CVE-2022-46463

CWE-200

High

Adobe Experience Manager Expression Language injection via cloudsettings

CVE-2025-54246

CWE-94

High

Adobe Experience Manager SSRF via MS token verify servlet

CVE-2025-54246

CWE-918

High

Adobe Experience Manager Blind XXE via package upload

CVE-2025-54246

CWE-611

High

Adobe Experience Manager exposed user passwords via querybuilder

CVE-2025-54246

CWE-200

High

Adobe Experience Manager writable JCR nodes via querybuilder

CVE-2025-54246

CWE-276

High

JWT Signature is not Verified

CWE-287

High

JWT Signature Bypass via unvalidated jwk parameter

CWE-287

High

Python Debugger Unauthorized Access Vulnerability

CWE-200

High

Node.js Debugger Unauthorized Access Vulnerability

CWE-200

High

SAP Knowledge Management and Collaboration (KMC) incorrect permissions

CWE-285

High

GoCD information disclosure (CVE-2021-43287)

CVE-2021-43287

CWE-200

High

Insecure Transportation Security Protocol Supported (SSLv2)

CWE-326

High