Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filterssbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
HAPI FHIR HTTP authentication leak in redirects
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
Jenkins has a link following vulnerability allows arbitrary file creation
Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
SQL Injection in Spring AI MariaDBFilterExpressionConverter
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Apache Spark: Spark History Server Code Execution Vulnerability
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Apache Livy: Restrict file access
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
Vaadin: Specially crafted ZIP archives can escape the intended extraction directory
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
Keycloak SAML Broken has Authentication Bypass by Primary Weakness
The Eclipse Jetty Server Artifact has a Gzip request memory leak
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.