Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersGeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format
Eclipse Jersey has a Race Condition
lsFusion Server is vulnerable to Path Traversal through its unpackFile function
WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks
Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form
Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files
Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files
Jenkins JDepend Plugin vulnerable to XML external entity attacks
Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools
Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form
Keycloak TLS Client-Initiated Renegotiation Denial of Service
InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement
Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection
GeoIP processor disables SSL certificate validation when downloading databases
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
JDBC Driver for SQL Server has improper input validation issue
PowerJob OpenAPIController is missing authorization
Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.