All · Log4j

Newest first. Every filter here is also a feed: see the subscribe box.

1. 4.9med
   CVE-2025-7203Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

   Log4j
   18 d ago 2026-10-19
2. 7.8high
   CVE-2026-85656OS command injection in Amazon log4j-cve-2021-44228-hotpatch

   EPSS 1.1% chance of exploitation in 30 days, percentile 65%EPSS 1.1%Log4j
   2 mo ago 2026-09-04
3. 5.9med
   CVE-2026-49844Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

   Log4jmaven
   3 mo ago 2026-07-10
4. 7.5high
   CVE-2026-34481Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

   Log4jmaven
   6 mo ago 2026-04-10
5. 7.5high
   CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

   EPSS 1.0% chance of exploitation in 30 days, percentile 64%EPSS 1.0%Log4jmaven
   6 mo ago 2026-04-10
6. 7.5high
   CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

   Log4jmaven
   6 mo ago 2026-04-10
7. 7.5high
   CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

   Log4jmaven
   6 mo ago 2026-04-10
8. 5.9med
   CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

   Log4jmaven
   6 mo ago 2026-04-10
9. 4.8med
   CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appender

   Log4jmaven
   10 mo ago 2025-12-18
10. 7.5high
    CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

    EPSS 1.9% chance of exploitation in 30 days, percentile 80%EPSS 1.9%Log4jmaven
    3 y ago 2023-03-10
11. 8.8high
    CVE-2022-0070Log4j hot patch package privilege escalation

    Log4j
    4 y ago 2022-04-19
12. 8.8high
    CVE-2021-3100Log4j hot patch package privilege escalation

    Log4j
    4 y ago 2022-04-19
13. 5.5med
    CVE-2022-21704Incorrect Default Permissions in log4js-node

    Log4jnpm
    4 y ago 2022-01-19
14. 8.8high
    CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

    EPSS 54.4% chance of exploitation in 30 days, percentile 99%EPSS 54.4%Log4jmaven
    4 y ago 2022-01-18
15. 9.8crit
    CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V1

    EPSS 66.5% chance of exploitation in 30 days, percentile 99%EPSS 66.5%Log4jmaven
    4 y ago 2022-01-18
16. 8.8high
    CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

    EPSS 63.8% chance of exploitation in 30 days, percentile 99%EPSS 63.8%Log4jmaven
    4 y ago 2022-01-18
17. 6.6med
    CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

    EPSS 97.9% chance of exploitation in 30 days, percentile 100%EPSS 97.9%Log4jmaven
    4 y ago 2021-12-28
18. 5.9med
    CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

    EPSS 100.0% chance of exploitation in 30 days, percentile 100%EPSS 100.0%Log4jmaven
    4 y ago 2021-12-18
19. 9.0crit
    CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    KEV · ransomwareEPSS 100.0% chance of exploitation in 30 days, percentile 100%EPSS 100.0%Log4jmaven
    4 y ago 2021-12-14
20. 7.5high
    CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

    EPSS 80.6% chance of exploitation in 30 days, percentile 100%EPSS 80.6%Log4jmaven
    4 y ago 2021-12-14
21. 10.0crit
    CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    KEV · ransomware3 exploitsEPSS 100.0% chance of exploitation in 30 days, percentile 100%EPSS 100.0%Log4jmaven
    4 y ago 2021-12-10
22. 9.8crit
    CVE-2020-9493Java deserialization in Chainsaw

    EPSS 4.6% chance of exploitation in 30 days, percentile 92%EPSS 4.6%Log4j
    5 y ago 2021-06-16
23. 3.7low
    CVE-2020-9488Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

    EPSS 8.2% chance of exploitation in 30 days, percentile 95%EPSS 8.2%Log4jmaven
    6 y ago 2020-04-27
24. 9.8crit
    CVE-2019-17571Deserialization of Untrusted Data in Log4j

    EPSS 70.0% chance of exploitation in 30 days, percentile 99%EPSS 70.0%Log4jmaven
    6 y ago 2019-12-20
25. 9.8crit
    CVE-2017-5645Deserialization of Untrusted Data in Log4j

    EPSS 89.4% chance of exploitation in 30 days, percentile 100%EPSS 89.4%Log4jmaven
    9 y ago 2017-04-17