High
CVE-2026-107227
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 191
Reset filters
Medium
CVE-2026-73245
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Medium
CVE-2026-61799
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
High
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
Medium
CVE-2026-56818
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
High
CVE-2026-59901
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Medium
CVE-2026-59899
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
High
CVE-2026-56822
Netty: TOCTOU in OcspServerCertificateValidator
High
CVE-2026-56821
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-56817
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
High
CVE-2026-55833
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
High
CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded settings map
High
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Low
ghsa-j6hm-v3x2-qv6j
land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
Low
CVE-2026-49989
CrateDB's Blob HTTP handler bypasses authorization
Medium
CVE-2026-57300
Jenkins MCP Server Plugin missing a permission check
High
CVE-2026-57296
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Medium
CVE-2026-57282
Jenkins Git client Plugin has an OS command injection vulnerability on agents
Medium
CVE-2026-57284
Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
Medium
CVE-2026-57283
Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.