Briefing Zero-days CVEs IOCs NewsActors Vendors Licenses Help

⌘+KWorkspace→

Real-time security intelligence — KEV, CVEs, exploits, threat actors and IOCs unified into one live view.

Sources Status API docs RSS feeds Licenses Help Security disclosure

Built by Kiril Urbonas

ZeroDayAttack — AppSec intelligence aggregator

6 results

For "Log4j2" across CVEs, vendor advisories, threat actors, IOCs, security research, and news.

All6 Vulnerabilities5 Threat actors0 Vendor advisories0 Research1 News0 IOCs0

Vulnerabilities

CVE-2021-45105Medium· 5.92026-08-25
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of
CVE-2021-44228Critical· 10.0KEVEXPLOIT2026-08-11
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoint

CVE-2023-50780High· 8.82026-06-15

Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not me

CVE-2021-44832Medium· 6.62026-05-29

Improper Input Validation and Injection in Apache Log4j2

CVE-2021-45046Critical· 9.0KEVEXPLOIT2023-05-01

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Research

snyk
Log4j vulnerability explained: Prevent Log4Shell RCE by updating to version 2.17.1
A new critical vulnerability was disclosed for log4j, a very popular Java logging framework from the Apache foundation. All current versions of log4j2 up to 2.14.1 are vulnerable. You can remediate this vulnerability by updating to version
2021-12-10