By clicking “Accept”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
DenyAccept
18px_cookie
e-remove
Research > Threat Research

Endor Labs Threat Research

Move beyond CVE lists with enriched vulnerability intelligence, reachability and exploitability context, and built-in remediation—including drop-in patches when upgrades aren’t an option.

Glowing green digital graphic depicting an unlocked padlock and a warning symbol. Text reads "CVE-2026-XXXXX", suggesting cybersecurity vulnerability.
3055
Sort by Severity Level
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

CVEs

10
Fix Available

CVE-2021-44228

Summary Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per Apache&apos;s Log4j security guide : Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and …

EPSS Score
1
10
Fix Available

CVE-2024-1597

Impact SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver wh…

EPSS Score
0.91821
10
Fix Available

CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

EPSS Score
0.95686
10
Fix Available

CVE-2023-46604

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause th…

EPSS Score
0.99965
10
Fix Available

CVE-2022-22947

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted r…

EPSS Score
0.99915
ENDOR LABS PATCHES

Get Your First
3 Patches Free

Book a Demo

Latest Research

CVE-2026-25896: Entity Encoding Bypass in fast-xml-parser
Read now
AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass
Read now

Get a Demo

ENDOR LABS PATCHES

Fix Vulnerabilities Without Upgrading

Book a Demo

How Endor Patches work

Security fixes are often several versions ahead—bundled with changes that can break your code.
Endor Patches deliver the maintainer-approved fix, tested for compatibility with older versions. Get just the security fix now, and upgrade on your timeline.
Diagram showing a backported security patch (version 1.1-endor-latest) applied to version 1.1, letting you fix a vulnerability now and upgrade to the patched version 1.4 later.

See for yourself why Endor Labs is the fastest growing AppSec company ever

This is some text inside of a div block.