Skip to content
OpenAdvisories

Package · Wolfi

gradle-stage0

40 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2025-52999 Public exploit

    jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

    jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a Stackov…

    FasterXML jackson-core druid tez Debian Ubuntu Wolfi Maven
  • High 8.3
    CVE-2022-1471 Public exploit EPSS 100%

    Remote Code execution in SnakeYAML

    SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

    SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven