FU
Product
Fuse
On CISA KEVExploited in the wild
29
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 10Medium 11Low 0
Watch
Add Fuse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-4437 In wildKEV | 9.8 | Jun 7 | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access… Affected: 1.0 |
| CVE-2015-1427 In wildKEV | 9.8 | Feb 17 | The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell… Affected: 1.0.0 |
| CVE-2018-1270 | 9.8 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a… Affected: 1.0.0 |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: 1.0 |
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: 7.0.0 |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: 7.0.0 |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: 7.0.0 |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: 7.0.0 |
Showing 8