Java

Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882) new KEV RW EPSS 100%CVE-2025-61882webCRITICAL 9.8Patched2026-08-09Alibaba Fastjson 1.x checkAutoType Bypass to Remote Code Execution via jar:http SSRF and fd-Reread Trick (CVE-2026-16723) new EPSS 16%CVE-2026-16723webCRITICAL 9Unpatched2026-07-31Spring Cloud Gateway Actuator RCE — Vulnerable Environment Lab (CVE-2025-41243) newCVE-2025-41243webCRITICAL 10Unpatched2026-07-06Apache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065) new EPSS 43%CVE-2025-30065miscCRITICAL 9.8Patched2026-07-06Thymeleaf SpEL Injection Remote Code Execution (CVE-2026-41901) newCVE-2026-41901webCRITICALPatched2026-07-05Spring Security Lazy Header Writing Security Header Bypass (CVE-2026-22732) newCVE-2026-22732webCRITICAL 9.1Patched2026-07-05Spring AI SimpleVectorStore SpEL Injection RCE (CVE-2026-22738) newCVE-2026-22738webCRITICAL 9.8Patched2026-07-05Samsung Android AT-Command Filter Bypass to system_server Code Execution (CVE-2026-20980) newCVE-2026-20980binaryCRITICALUnverified2026-07-05pac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000 newCVE-2026-29000webCRITICAL 9.8Patched2026-07-05OpenAM Pre-Authentication RCE via `jato.clientSession` Deserialization (CVE-2026-33439) new EPSS 10%CVE-2026-33439webCRITICAL 9.8Patched2026-07-05Jinjava Server-Side Template Injection to RCE via Jackson ObjectMapper (CVE-2026-25526) newCVE-2026-25526webCRITICALPatched2026-07-05Apache Tomcat Tribes EncryptInterceptor Fail-Open Unauthenticated RCE (CVE-2026-34486) new KEV EPSS 99%CVE-2026-34486webCRITICALPatched2026-07-05Apache Tomcat Split-Collection Security Constraint Bypass (CVE-2026-43515) newCVE-2026-43515webHIGHPatched2026-07-05Apache Tomcat Mutual TLS OCSP Soft-Fail Authentication Bypass — CVE-2026-29145 newCVE-2026-29145webCRITICAL 9.1Patched2026-07-05Apache Solr Velocity Template Injection RCE (CVE-2026-44825) newCVE-2026-44825webCRITICAL 9.8Patched2026-07-05Apache MINA acceptMatchers Deserialization Filter Bypass to RCE (CVE-2026-42779) newCVE-2026-42779networkCRITICAL 9.8Patched2026-07-05Confluence SSTI RCE - CVE-2023-22527 new KEV RW EPSS 100%CVE-2023-22527webCRITICAL 10Patched2026-05-17Confluence Post-Auth RCE - CVE-2024-21683 new EPSS 88%CVE-2024-21683webHIGH 8.3Unverified2026-05-17Apache Parquet Java Unsafe Deserialization RCE (CVE-2025-30065) new EPSS 43%CVE-2025-30065miscCRITICAL 10Patched2026-05-16