Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersland.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
CrateDB's Blob HTTP handler bypasses authorization
GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field
GeoNetwork has reflected XSS through client-side template injection
Sigstore Java has a vulnerability with bundle verification of integratedTime
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
OpenAM Authenticated RCE via Groovy Sandbox Escape
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
OpenAM Authentication Bypass via MSISDN LDAP Injection
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
nextflow auth login command has incorrect default permissions
OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
OpenAM Arbitrary OAuth Token Minting via Push Registration
OpenAM has Unsafe Java Deserialization via SNS
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
Payara Server Full has a Cross-Site Request Forgery vulnerability
Jenkins Zowe zDevOps Plugin has a CSRF vulnerability
Jenkins Zowe zDevOps Plugin has a missing permission check
Jenkins MCP Server Plugin missing a permission check
Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.