Frameworks and libraries

Software components embedded in other applications: Java, .NET, Log4j, Spring, PHP…

For example: Java, Log4j, Apache Struts, Spring.

Category RSS feed

5 vulnerabilities added in the last 12 months
76 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

Affected brands

In alphabetical order, with their number of vulnerabilities in this category.

Adobe 1 vulnerability
Ajax.NET Professional 1 vulnerability · 1 in the last 12 months
Apache 11 vulnerabilities
Artifex 1 vulnerability
Erlang 1 vulnerability
ExifTool 1 vulnerability
FreeType 1 vulnerability
ImageMagick 3 vulnerabilities
jQuery 1 vulnerability
Laravel 3 vulnerabilities · 1 in the last 12 months
Microsoft 4 vulnerabilities
OpenSSL 1 vulnerability
Oracle 14 vulnerabilities
PEAR 2 vulnerabilities
PHP 3 vulnerabilities
PHPMailer 1 vulnerability
PrimeTek 1 vulnerability
Progress 4 vulnerabilities
Protocoles (IETF) 1 vulnerability
React (Meta) 1 vulnerability · 1 in the last 12 months
Red Hat 2 vulnerabilities
Ruby on Rails 3 vulnerabilities
Spreadsheet::ParseExcel 1 vulnerability
Spring 5 vulnerabilities
Starlette 1 vulnerability · 1 in the last 12 months
systeminformation (npm) 1 vulnerability
TanStack 1 vulnerability · 1 in the last 12 months
ThinkPHP 2 vulnerabilities
Treck 1 vulnerability
XStream 1 vulnerability
Yii Framework 1 vulnerability
ZK Framework 1 vulnerability

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this category.

Rank 1
React (Meta) React Server ComponentsCVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
Ransomware
CVSS severity 10.0critical
Added Dec 5, 2025
Rank 2
Ajax.NET ProfessionalCVE-2021-23758
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
CVE from 2021, added in 2026
CVSS severity 9.8critical
Added Aug 26, 2026
Rank 3
Laravel LivewireCVE-2025-54068
Laravel Livewire Code Injection Vulnerability
CVSS severity 9.8critical
Added Mar 20, 2026
Rank 4
TanStackCVE-2026-45321
TanStack Unspecified Vulnerability
Ransomware
CVSS severity 9.6critical
Added May 27, 2026
Rank 5
StarletteCVE-2026-48710
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
CVSS severity 6.5medium
Added Sep 2, 2026
Rank 6
Erlang/OTPCVE-2025-32433
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
CVSS severity 10.0critical
Added Jun 9, 2025
Rank 7
Spring Cloud GatewayCVE-2022-22947
VMware Spring Cloud Gateway Code Injection Vulnerability
CVSS severity 10.0critical
Added May 16, 2022
Rank 8
Apache Log4jCVE-2021-44228
Apache Log4j2 Remote Code Execution Vulnerability
Ransomware
CVSS severity 10.0critical
Added Dec 10, 2021
Rank 9
PHPMailerCVE-2016-10033
PHPMailer Command Injection Vulnerability
CVE from 2016, added in 2025
CVSS severity 9.8critical
Added Jul 7, 2025
Rank 10
Yii Framework YiiCVE-2024-58136
Yiiframework Yii Improper Protection of Alternate Path Vulnerability
CVSS severity 9.8critical
Added May 2, 2025

Show 66 more vulnerabilities

Rank 11
Oracle ADF FacesCVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
CVE from 2022, added in 2024
CVSS severity 9.8critical
Added Sep 18, 2024
Rank 12
PHPCVE-2024-4577
PHP-CGI OS Command Injection Vulnerability
Ransomware
CVSS severity 9.8critical
Added Jun 12, 2024
Rank 13
Red Hat JBoss RichFacesCVE-2018-14667
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
CVE from 2018, added in 2023
CVSS severity 9.8critical
Added Sep 28, 2023
Rank 14
Laravel IgnitionCVE-2021-3129
Laravel Ignition File Upload Vulnerability
RansomwareCVE from 2021, added in 2023
CVSS severity 9.8critical
Added Sep 18, 2023
Rank 15
Oracle Java SE (JRE / JDK)CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
CVE from 2016, added in 2023
CVSS severity 9.8critical
Added May 12, 2023
Rank 16
Progress Telerik UI for ASP.NET AJAXCVE-2017-11357
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
RansomwareCVE from 2017, added in 2023
CVSS severity 9.8critical
Added Jan 26, 2023
Rank 17
Spring Cloud FunctionCVE-2022-22963
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Aug 25, 2022
Rank 18
Oracle Java SE (JRE / JDK)CVE-2010-0840
Oracle JRE Unspecified Vulnerability
CVE from 2010, added in 2022
CVSS severity 9.8critical
Added May 25, 2022
Rank 19
Oracle Java SE (JRE / JDK)CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability
RansomwareCVE from 2013, added in 2022
CVSS severity 9.8critical
Added May 25, 2022
Rank 20
Progress Telerik UI for ASP.NET AJAXCVE-2017-11317
Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
CVE from 2017, added in 2022
CVSS severity 9.8critical
Added Apr 11, 2022
Rank 21
Spring FrameworkCVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Apr 4, 2022
Rank 22
Oracle Java SE (JRE / JDK)CVE-2012-5076
Oracle Java SE Sandbox Bypass Vulnerability
CVE from 2012, added in 2022
CVSS severity 9.8critical
Added Mar 28, 2022
Rank 23
Oracle Java SE (JRE / JDK)CVE-2013-2465
Oracle Java SE Unspecified Vulnerability
RansomwareCVE from 2013, added in 2022
CVSS severity 9.8critical
Added Mar 28, 2022
Rank 24
PHPCVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
CVE from 2012, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
Rank 25
Apache StrutsCVE-2013-2251
Apache Struts Improper Input Validation Vulnerability
CVE from 2013, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
Rank 26
Spring DataCVE-2018-1273
VMware Tanzu Spring Data Commons Property Binder Vulnerability
RansomwareCVE from 2018, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
Rank 27
PHPCVE-2019-11043
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
Rank 28
Oracle Java SE (JRE / JDK)CVE-2011-3544
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CVE from 2011, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 29
Oracle Java SE (JRE / JDK)CVE-2012-0507
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
RansomwareCVE from 2012, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 30
Oracle Java SE (JRE / JDK)CVE-2012-1723
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
RansomwareCVE from 2012, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 31
Oracle Java SE (JRE / JDK)CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
RansomwareCVE from 2012, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 32
Oracle Java SE (JRE / JDK)CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
CVE from 2015, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 33
Apache Struts 1CVE-2017-9791
Apache Struts 1 Improper Input Validation Vulnerability
CVE from 2017, added in 2022
CVSS severity 9.8critical
Added Feb 10, 2022
Rank 34
Apache StrutsCVE-2012-0391
Apache Struts 2 Improper Input Validation Vulnerability
CVE from 2012, added in 2022
CVSS severity 9.8critical
Added Jan 21, 2022
Rank 35
PrimeTek PrimeFacesCVE-2017-1000486
Primetek Primefaces Remote Code Execution Vulnerability
CVE from 2017, added in 2022
CVSS severity 9.8critical
Added Jan 10, 2022
Rank 36
Apache ShiroCVE-2016-4437
Apache Shiro Code Execution Vulnerability
CVE from 2016, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 37
Apache StrutsCVE-2017-5638
Apache Struts Remote Code Execution Vulnerability
RansomwareCVE from 2017, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 38
Progress Telerik UI for ASP.NET AJAXCVE-2017-9248
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
CVE from 2017, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 39
ThinkPHPCVE-2018-20062
ThinkPHP "noneCms" Remote Code Execution Vulnerability
CVE from 2018, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 40
Progress Telerik UI for ASP.NET AJAXCVE-2019-18935
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
RansomwareCVE from 2019, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 41
Microsoft .NET / Visual StudioCVE-2020-0646
Microsoft .NET Framework Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 42
Apache StrutsCVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 43
Apache Log4jCVE-2021-45046
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
RansomwareCVE from 2021, added in 2023
CVSS severity 9.0critical
Added May 1, 2023
Rank 44
Red Hat JBoss SeamCVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
CVE from 2010, added in 2021
CVSS severity 8.8high
Added Dec 10, 2021
Rank 45
ThinkPHPCVE-2019-9082
ThinkPHP Remote Code Execution Vulnerability
CVE from 2019, added in 2021
CVSS severity 8.8high
Added Nov 3, 2021
Rank 46
XStreamCVE-2021-39144
XStream Remote Code Execution Vulnerability
CVE from 2021, added in 2023
CVSS severity 8.5high
Added Mar 10, 2023
Rank 47
ImageMagickCVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
CVE from 2016, added in 2024
CVSS severity 8.4high
Added Sep 9, 2024
Rank 48
FreeTypeCVE-2025-27363
FreeType Out-of-Bounds Write Vulnerability
CVSS severity 8.1high
Added May 6, 2025
Rank 49
Laravel FrameworkCVE-2018-15133
Laravel Deserialization of Untrusted Data Vulnerability
CVE from 2018, added in 2024
CVSS severity 8.1high
Added Jan 16, 2024
Rank 50
Apache StrutsCVE-2017-9805
Apache Struts Deserialization of Untrusted Data Vulnerability
CVE from 2017, added in 2021
CVSS severity 8.1high
Added Nov 3, 2021
Rank 51
Apache StrutsCVE-2018-11776
Apache Struts Remote Code Execution Vulnerability
CVE from 2018, added in 2021
CVSS severity 8.1high
Added Nov 3, 2021
Rank 52
Spreadsheet::ParseExcelCVE-2023-7101
Spreadsheet::ParseExcel Remote Code Execution Vulnerability
CVSS severity 7.8high
Added Jan 2, 2024
Rank 53
PEAR Archive_TarCVE-2020-28949
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
CVE from 2020, added in 2022
CVSS severity 7.8high
Added Aug 25, 2022
Rank 54
Artifex GhostscriptCVE-2017-8291
Artifex Ghostscript Type Confusion Vulnerability
CVE from 2017, added in 2022
CVSS severity 7.8high
Added May 24, 2022
Rank 55
systeminformation (npm) systeminformationCVE-2021-21315
System Information Library for Node.JS Command Injection
CVSS severity 7.8high
Added Jan 18, 2022
Rank 56
ExifToolCVE-2021-22204
ExifTool Remote Code Execution Vulnerability
CVSS severity 7.8high
Added Nov 17, 2021
Rank 57
Microsoft .NET / Visual StudioCVE-2017-8759
Microsoft .NET Framework Remote Code Execution Vulnerability
CVE from 2017, added in 2021
CVSS severity 7.8high
Added Nov 3, 2021
Rank 58
Ruby on RailsCVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability
CVE from 2019, added in 2025
CVSS severity 7.5high
Added Jul 7, 2025
Rank 59
Microsoft .NET / Visual StudioCVE-2024-29059
Microsoft .NET Framework Information Disclosure Vulnerability
CVSS severity 7.5high
Added Feb 4, 2025
Rank 60
Protocoles (IETF) Service Location Protocol (SLP)CVE-2023-29552
Service Location Protocol (SLP) Denial-of-Service Vulnerability
CVSS severity 7.5high
Added Nov 8, 2023
Rank 61
Microsoft .NET / Visual StudioCVE-2023-38180
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
CVSS severity 7.5high
Added Aug 9, 2023
Rank 62
ZK Framework AuUploaderCVE-2022-36537
ZK Framework AuUploader Unspecified Vulnerability
Ransomware
CVSS severity 7.5high
Added Feb 27, 2023
Rank 63
PEAR Archive_TarCVE-2020-36193
PEAR Archive_Tar Improper Link Resolution Vulnerability
CVE from 2020, added in 2022
CVSS severity 7.5high
Added Aug 25, 2022
Rank 64
OpenSSLCVE-2014-0160
OpenSSL Information Disclosure Vulnerability
CVE from 2014, added in 2022
CVSS severity 7.5high
Added May 4, 2022
Rank 65
Ruby on RailsCVE-2014-0130
Ruby on Rails Directory Traversal Vulnerability
CVE from 2014, added in 2022
CVSS severity 7.5high
Added Mar 25, 2022
Rank 66
Ruby on RailsCVE-2016-0752
Ruby on Rails Directory Traversal Vulnerability
CVE from 2016, added in 2022
CVSS severity 7.5high
Added Mar 25, 2022
Rank 67
Spring Cloud ConfigCVE-2020-5410
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
CVE from 2020, added in 2022
CVSS severity 7.5high
Added Mar 25, 2022
Rank 68
Apache Struts 1CVE-2006-1547
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
CVE from 2006, added in 2022
CVSS severity 7.5high
Added Jan 21, 2022
Rank 69
Adobe BlazeDSCVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
RansomwareCVE from 2009, added in 2022
CVSS severity 6.5medium
Added Mar 7, 2022
Rank 70
jQueryCVE-2020-11023
JQuery Cross-Site Scripting (XSS) Vulnerability
CVE from 2020, added in 2025
CVSS severity 6.1medium
Added Jan 23, 2025
Rank 71
ImageMagickCVE-2016-3715
ImageMagick Arbitrary File Deletion Vulnerability
CVE from 2016, added in 2021
CVSS severity 5.5medium
Added Nov 3, 2021
Rank 72
ImageMagickCVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
CVE from 2016, added in 2021
CVSS severity 5.5medium
Added Nov 3, 2021
Rank 73
Treck Pile TCP/IPCVE-2020-11899
Treck TCP/IP stack Out-of-Bounds Read Vulnerability
CVE from 2020, added in 2022
CVSS severity 5.4medium
Added Mar 3, 2022
Rank 74
Oracle Java SE (JRE / JDK)CVE-2015-4902
Oracle Java SE Integrity Check Vulnerability
CVE from 2015, added in 2022
CVSS severity 5.3medium
Added Mar 3, 2022
Rank 75
Oracle Java SE (JRE / JDK)CVE-2013-0431
Oracle JRE Sandbox Bypass Vulnerability
RansomwareCVE from 2013, added in 2022
CVSS severity 3.7low
Added May 25, 2022
Rank 76
Oracle Java SE (JRE / JDK)CVE-2013-2423
Oracle JRE Unspecified Vulnerability
CVE from 2013, added in 2022
CVSS severity 3.7low
Added May 25, 2022

Filed under another category

This vulnerability also concerns this type of product, but is counted in its main category. My radar finds it when you follow this category.

Microsoft SharePoint ServerCVE-2020-1147
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
CVSS severity 7.8high
Added Nov 3, 2021

Get new vulnerabilities in this category: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

Affected brands

See also

Patch first

Filed under another category

Follow and verify