CVE-2026-9680 | Medium | 5.8 | 2026-07-28 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP end… |
CVE-2026-16723 | Critical | 9.0 | 2026-07-23 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configur… |
CVE-2025-70974 | Critical | 10.0 | 2026-01-09 | Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may b… |
CVE-2020-21699 | High | 7.5 | 2023-08-22 | The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter… |
CVE-2021-43116 | High | 8.8 | 2022-07-05 | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change… |
CVE-2022-25845 | High | 8.1 | 2022-06-10 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, whi… |
CVE-2021-44667 | Medium | 6.1 | 2022-03-11 | A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters. |
CVE-2021-33800 | High | 7.5 | 2021-11-03 | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. |
CVE-2021-29442 | High | 8.6 | 2021-04-27 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController let… |
CVE-2021-29441 | High | 8.6 | 2021-04-27 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use auth… |
CVE-2020-19676 | Medium | 5.3 | 2020-09-30 | Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names… |
CVE-2017-18349 | Critical | 9.8 | 2018-10-23 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a cr… |
CVE-2014-5976 | | | 2014-09-20 | The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2007-0827 | | | 2007-02-07 | The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove met… |