Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.3Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net…Apr 10, 2026
- Medium6.3Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON…Apr 10, 2026
- Medium6.9Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters…Apr 10, 2026
- Medium6.9The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output.Apr 10, 2026
- Medium6.9Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log inje…Apr 10, 2026
- Medium6.3The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.…Apr 10, 2026
- Medium6.5CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.Apr 9, 2026
- Medium5.3Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.Apr 9, 2026
- Critical9.0Apache Log4j2 Deserialization of Untrusted Data VulnerabilityKEVEPSS 100.0%Dec 14, 2021
- Critical10.0Apache Log4j2 Remote Code Execution VulnerabilityKEVEPSS 100.0%Dec 10, 2021
- UnknownCVE-2026-87022 is listed by an advisory.Unknown date
- UnknownCVE-2026-86350 is listed by an advisory.Unknown date
- UnknownCVE-2026-86248 is listed by an advisory.Unknown date
- UnknownCVE-2026-79677 is listed by an advisory.Unknown date
- UnknownCVE-2026-78437 is listed by an advisory.Unknown date
- UnknownCVE-2026-78383 is listed by an advisory.Unknown date
- UnknownCVE-2026-77791 is listed by an advisory.Unknown date
- UnknownCVE-2026-77762 is listed by an advisory.Unknown date
- UnknownCVE-2026-77756 is listed by an advisory.Unknown date
- UnknownCVE-2026-76183 is listed by an advisory.Unknown date
- UnknownCVE-2026-75973 is listed by an advisory.Unknown date
- UnknownCVE-2026-73581 is listed by an advisory.Unknown date
- UnknownCVE-2026-73180 is listed by an advisory.Unknown date
- UnknownCVE-2026-68763 is listed by an advisory.Unknown date
- UnknownCVE-2026-68569 is listed by an advisory.Unknown date