Quarkus kayıtları
quarkus üreticisine ait 54 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %94,4
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-20 Improper Input Validation5
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')4
- CWE-378 Creation of Temporary File With Insecure Permissions4
- CWE-209 Generation of Error Message Containing Sensitive Information2
- CWE-203 Observable Discrepancy2
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm2
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
54 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
49Planlayın | CVE-2022-4116İstismar yok | A vulnerability was found in quarkus.quarkus · quarkus | Kritik9,8 | — | %32,5 | 22 Kas 2022 |
40Planlayın | CVE-2022-21724İstismar yok | Unchecked Class Instantiation when providing Plugin Classespostgresql · postgresql jdbc driver · CWE-665 | Kritik9,8 | — | %3,0 | 2 Şub 2022 |
40Planlayın | CVE-2022-2466Kavram kanıtı | It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.quarkus · quarkus · CWE-444 | Kritik9,8 | — | %1,8 | 31 Ağu 2022 |
39İzleyin | CVE-2021-26291Kavram kanıtı | block repositories using http by defaultapache · maven · CWE-346 | Kritik9,1 | — | %8,6 | 23 Nis 2021 |
39İzleyin | CVE-2023-6267İstismar yok | Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.quarkus · quarkus · CWE-755 | Kritik9,8 | — | %0,7 | 25 Oca 2024 |
38İzleyin | CVE-2017-18640İstismar yok | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.snakeyaml project · snakeyaml · CWE-776 | Yüksek7,5 | — | %26,7 | 11 Ara 2019 |
37İzleyin | CVE-2025-14813İstismar yok | GOSTCTR implementation unable to process more than 255 blocks correctlylegion of the bouncy castle inc. · bc-java · CWE-327 | Kritik9,3 | — | %0,3 | 15 Nis 2026 |
36İzleyin | CVE-2020-1714İstismar yok | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.redhat · keycloak · CWE-20 | Yüksek8,8 | — | %2,6 | 13 May 2020 |
36İzleyin | CVE-2023-6394İstismar yok | Quarkus: graphql operations over websockets bypassquarkus · quarkus · CWE-862 | Kritik9,1 | — | %0,8 | 9 Ara 2023 |
36İzleyin | CVE-2024-12225İstismar yok | Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypassquarkus · quarkus · CWE-288 | Kritik9,1 | — | %0,4 | 6 May 2025 |
35İzleyin | CVE-2020-25649İstismar yok | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.fasterxml · jackson-databind · CWE-611 | Yüksek7,5 | — | %17,7 | 3 Ara 2020 |
35İzleyin | CVE-2022-0981İstismar yok | A flaw was found in Quarkus.quarkus · quarkus · CWE-863 | Yüksek8,8 | — | %1,1 | 23 Mar 2022 |
35İzleyin | CVE-2026-5598İstismar yok | Non-constant time comparisons risk private key leakage in FrodoKEM.legion of the bouncy castle inc. · bc-java · CWE-385 | Yüksek8,9 | — | %0,9 | 15 Nis 2026 |
35İzleyin | CVE-2026-39852İstismar yok | Quarkus authorization bypass via semicolon path normalization inconsistencyquarkus · quarkus · CWE-863 | Yüksek8,8 | — | %0,6 | 5 May 2026 |
32İzleyin | CVE-2021-37714İstismar yok | Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsjsoup · jsoup · CWE-248 | Yüksek7,5 | — | %6,6 | 18 Ağu 2021 |
32İzleyin | CVE-2021-37137İstismar yok | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.netty · netty · CWE-400 | Yüksek7,5 | — | %6,5 | 19 Eki 2021 |
32İzleyin | CVE-2021-37136İstismar yok | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocatinetty · netty · CWE-400 | Yüksek7,5 | — | %5,9 | 19 Eki 2021 |
32İzleyin | CVE-2023-4853İstismar yok | Quarkus: http security policy bypassquarkus · quarkus · CWE-148 | Yüksek8,1 | — | %1,4 | 20 Eyl 2023 |
31İzleyin | CVE-2020-13692İstismar yok | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.postgresql · postgresql jdbc driver · CWE-611 | Yüksek7,7 | — | %4,0 | 4 Haz 2020 |
31İzleyin | CVE-2022-42003İstismar yok | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitivfasterxml · jackson-databind · CWE-502 | Yüksek7,5 | — | %3,4 | 2 Eki 2022 |
31İzleyin | CVE-2022-42004İstismar yok | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromfasterxml · jackson-databind · CWE-502 | Yüksek7,5 | — | %3,4 | 2 Eki 2022 |
31İzleyin | CVE-2020-28491İstismar yok | Denial of Service (DoS)fasterxml · jackson-dataformats-binary · CWE-770 | Yüksek7,5 | — | %3,0 | 18 Şub 2021 |
31İzleyin | CVE-2021-29428İstismar yok | Local privilege escalation through system temporary directorygradle · gradle · CWE-378 | Yüksek7,8 | — | %0,5 | 13 Nis 2021 |
30İzleyin | CVE-2020-25638İstismar yok | A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.hibernate · hibernate orm · CWE-89 | Yüksek7,4 | — | %2,9 | 2 Ara 2020 |
30İzleyin | CVE-2026-50559İstismar yok | Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilitiesquarkus · quarkus · CWE-287 | Yüksek7,5 | — | %1,0 | 19 Haz 2026 |
- CVE-2022-411649Planlayın
A vulnerability was found in quarkus.
KritikCVSS 9,8İstismar yokEPSS %32quarkus · quarkus22 Kas 2022
- CVE-2022-2172440Planlayın
Unchecked Class Instantiation when providing Plugin Classes
KritikCVSS 9,8İstismar yokEPSS %3postgresql · postgresql jdbc driver2 Şub 2022
- CVE-2022-246640Planlayın
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
KritikCVSS 9,8Kavram kanıtıEPSS %1quarkus · quarkus31 Ağu 2022
- CVE-2021-2629139İzleyin
block repositories using http by default
KritikCVSS 9,1Kavram kanıtıEPSS %8apache · maven23 Nis 2021
- CVE-2023-626739İzleyin
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
KritikCVSS 9,8İstismar yokEPSS %0quarkus · quarkus25 Oca 2024
- CVE-2017-1864038İzleyin
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
YüksekCVSS 7,5İstismar yokEPSS %26snakeyaml project · snakeyaml11 Ara 2019
- CVE-2025-1481337İzleyin
GOSTCTR implementation unable to process more than 255 blocks correctly
KritikCVSS 9,3İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java15 Nis 2026
- CVE-2020-171436İzleyin
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.
YüksekCVSS 8,8İstismar yokEPSS %2redhat · keycloak13 May 2020
- CVE-2023-639436İzleyin
Quarkus: graphql operations over websockets bypass
KritikCVSS 9,1İstismar yokEPSS %0quarkus · quarkus9 Ara 2023
- CVE-2024-1222536İzleyin
Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass
KritikCVSS 9,1İstismar yokEPSS %0quarkus · quarkus6 May 2025
- CVE-2020-2564935İzleyin
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
YüksekCVSS 7,5İstismar yokEPSS %17fasterxml · jackson-databind3 Ara 2020
- CVE-2022-098135İzleyin
A flaw was found in Quarkus.
YüksekCVSS 8,8İstismar yokEPSS %1quarkus · quarkus23 Mar 2022
- CVE-2026-559835İzleyin
Non-constant time comparisons risk private key leakage in FrodoKEM.
YüksekCVSS 8,9İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java15 Nis 2026
- CVE-2026-3985235İzleyin
Quarkus authorization bypass via semicolon path normalization inconsistency
YüksekCVSS 8,8İstismar yokEPSS %0quarkus · quarkus5 May 2026
- CVE-2021-3771432İzleyin
Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
YüksekCVSS 7,5İstismar yokEPSS %6jsoup · jsoup18 Ağu 2021
- CVE-2021-3713732İzleyin
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.
YüksekCVSS 7,5İstismar yokEPSS %6netty · netty19 Eki 2021
- CVE-2021-3713632İzleyin
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati
YüksekCVSS 7,5İstismar yokEPSS %5netty · netty19 Eki 2021
- CVE-2023-485332İzleyin
Quarkus: http security policy bypass
YüksekCVSS 8,1İstismar yokEPSS %1quarkus · quarkus20 Eyl 2023
- CVE-2020-1369231İzleyin
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
YüksekCVSS 7,7İstismar yokEPSS %4postgresql · postgresql jdbc driver4 Haz 2020
- CVE-2022-4200331İzleyin
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitiv
YüksekCVSS 7,5İstismar yokEPSS %3fasterxml · jackson-databind2 Eki 2022
- CVE-2022-4200431İzleyin
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFrom
YüksekCVSS 7,5İstismar yokEPSS %3fasterxml · jackson-databind2 Eki 2022
- CVE-2020-2849131İzleyin
Denial of Service (DoS)
YüksekCVSS 7,5İstismar yokEPSS %3fasterxml · jackson-dataformats-binary18 Şub 2021
- CVE-2021-2942831İzleyin
Local privilege escalation through system temporary directory
YüksekCVSS 7,8İstismar yokEPSS %0gradle · gradle13 Nis 2021
- CVE-2020-2563830İzleyin
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.
YüksekCVSS 7,4İstismar yokEPSS %2hibernate · hibernate orm2 Ara 2020
- CVE-2026-5055930İzleyin
Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
YüksekCVSS 7,5İstismar yokEPSS %1quarkus · quarkus19 Haz 2026