Medium
CVE-2026-111761
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 311
Reset filters
High
CVE-2026-102834
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
An integer overflow in JavaCV's IP camera frame grabber can cause an infinite loop during buffer expansion when handling untrusted MJPEG HTTP streams. A malicious or modified response header can force the frame-grabbing thread into continuous 100% CPU utilization, resulting in a denial of service.
High
CVE-2026-107227
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
Medium
CVE-2026-106452
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header
High
CVE-2026-89425
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
Medium
CVE-2026-83557
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
High
CVE-2026-68497
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
High
CVE-2026-77422
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
High
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
High
CVE-2026-85058
io.moquette:moquette-broker has a Missing Authorization issue
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
High
CVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
High
CVE-2026-81875
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
High
CVE-2026-63126
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
High
CVE-2026-75516
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
High
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
High
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering
Critical
CVE-2026-11746
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Medium
CVE-2026-11748
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
Critical
CVE-2026-75595
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
High
CVE-2026-55848
MapFish Print has XXE that allows reading arbitrary files of certain types
Medium
CVE-2026-55549
Yamcs has Reflected XSS in the URL of the Authorize Endpoint
Critical
CVE-2026-55511
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
High
CVE-2026-54556
http4s has HTTP/2 Denial of Service with Ember Backend
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.