CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
XWiki Platform SolrSearch Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-24893)
[Affected Scope] XWiki Platform versions prior to 15.10.11, 16.4.1, and 16.5.0RC1
[Impact] Unauthenticated remote attackers can execute arbitrary Groovy code via the SolrSearch API, leading to complete compromise of the host system.
[Mitigation] Immediately upgrade to patched versions (15.10.11, 16.4.1, 16.5.0RC1 or later) or apply the recommended XML macro workaround.
Sonatype Nexus Repository Manager 3 Missing Access Control and Remote Code Execution (RCE) Vulnerability (CVE-2019-7238) Analysis & Remediation Guide
[Affected Scope] Sonatype Nexus Repository Manager versions prior to 3.15.0
[Impact] Unauthenticated remote attackers can execute arbitrary Groovy scripts and gain full system-level control by sending specially crafted HTTP POST requests
[Mitigation] Immediately upgrade to the latest stable version (3.15.0 or higher) or restrict external access to the vulnerable endpoints
Jenkins Script Security Plugin Sandbox Bypass Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2019-1003029)
[Affected Scope] Jenkins Script Security Plugin 1.53 and earlier
[Impact] Attackers with Overall/Read permission can bypass the Groovy sandbox to execute arbitrary code on the Jenkins master JVM
[Mitigation] Immediately update the Script Security Plugin to version 1.54 or later, and restrict unnecessary user permissions
Elasticsearch Groovy Scripting Engine Sandbox Escape and Remote Code Execution (RCE) Vulnerability (CVE-2015-1427)
[Affected Scope] Elasticsearch versions before 1.3.8 and 1.4.x versions before 1.4.3
[Impact] Unauthenticated remote attackers can bypass sandbox restrictions to execute arbitrary shell commands on the host system, leading to complete system compromise
[Mitigation] Immediately upgrade Elasticsearch to version 1.3.8, 1.4.3, or later, or disable dynamic scripting in the configuration