AL
Vendor
Alibaba
14
CVEs
0
On KEV
0
New 30D
Products
NA9.8
Nacos
Alibaba
5 CVEs0 on KEV0 new
FA10.0
Fastjson
Alibaba
4 CVEs0 on KEV0 new
AL–
Alibaba
Alibaba
1 CVEs0 on KEV0 new
AC5.8
Alibaba Cloud RDS OpenAPI MCP Server
Alibaba
1 CVEs0 on KEV0 new
AA–
Alipay Activex Control
Alibaba
1 CVEs0 on KEV0 new
DR7.5
Druid
Alibaba
1 CVEs0 on KEV0 new
TE7.5
Tengine
Alibaba
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-9680 | AC Alibaba Cloud RDS OpenAPI MCP Server Alibaba | 5.8 | Jul 28 | MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server |
| CVE-2026-16723 | FA Fastjson Alibaba | 9.0 | Jul 23 | Remote Code Execution in fastjson 1.2.68–1.2.83 |
| CVE-2025-70974 | FA Fastjson Alibaba | 10.0 | Jan 9 | Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain… |
| CVE-2020-21699 | TE Tengine Alibaba | 7.5 | Aug 22 | The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting… |
| CVE-2021-43116 | NA Nacos Alibaba | 8.8 | Jul 5 | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned… |
| CVE-2022-25845 | FA Fastjson Alibaba | 9.8 | Jun 10 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under… |
| CVE-2021-44667 | NA Nacos Alibaba | 6.1 | Mar 11 | A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters |
| CVE-2021-33800 | DR Druid Alibaba | 7.5 | Nov 3 | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal |
| CVE-2021-29442 | NA Nacos Alibaba | 7.5 | Apr 27 | Nacos is a platform designed for dynamic service discovery and configuration and service management |
| CVE-2021-29441 | NA Nacos Alibaba | 9.8 | Apr 27 | Nacos is a platform designed for dynamic service discovery and configuration and service management |
| CVE-2020-19676 | NA Nacos Alibaba | 5.3 | Sep 30 | Nacos 1.1.4 is affected by: Incorrect Access Control |
| CVE-2017-18349 | FA Fastjson Alibaba | 9.8 | Oct 23 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request,… |
| CVE-2014-5976 | AL Alibaba Alibaba | – | Sep 20 | The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
| CVE-2007-0827 | AA Alipay Activex Control Alibaba | – | Feb 7 | The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove method with an invalid… |