Briefing Zero-days CVEs IOCs NewsActors Vendors Licenses Help

⌘+KWorkspace→

Real-time security intelligence — KEV, CVEs, exploits, threat actors and IOCs unified into one live view.

Sources Status API docs RSS feeds Licenses Help Security disclosure

Built by Kiril Urbonas

ZeroDayAttack — AppSec intelligence aggregator

33 results

For "log4j" across CVEs, vendor advisories, threat actors, IOCs, security research, and news.

All33 Vulnerabilities13 Threat actors0 Vendor advisories6 Research14 News0 IOCs0

Vulnerabilities

CVE-2026-49844Medium· 5.919 h ago
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. T
CVE-2017-5645Critical· 9.817 d ago
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary
CVE-2019-17531Critical· 9.817 d ago

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache

CVE-2021-45105Medium· 5.92026-08-25

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of

CVE-2021-44228Critical· 10.0KEVEXPLOIT2026-08-11

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoint

CVE-2021-44832Medium· 6.62026-05-29

Improper Input Validation and Injection in Apache Log4j2

CVE-2020-9488Low· 3.72026-05-29

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

CVE-2019-17571Critical· 9.82026-05-28

Deserialization of Untrusted Data in Log4j

CVE-2022-23305Critical· 9.82026-05-27

SQL Injection in Log4j 1.2.x

CVE-2026-34480High· 7.52026-04-24

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

CVE-2026-34478High· 7.52026-04-24

Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

OSV-GHSA-3qpm-h9ch-px3c—2024-12-04

Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library

OSV-GHSA-3w6p-8f82-gw8r—2024-12-03

Using JMSAppender in log4j configuration may lead to deserialization of untrusted data