Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,601
Reset filtersKeycloak: Denial of Service via specially crafted SAML input
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation
Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
Vert.x has a DoS via unbounded server-side SNI SslContext cache growth
Spring Cloud Config Server Logged Sensitive Information
Spring Cloud Config Server Susceptible To TOCTOU Attack
Spring Cloud Config vulnerable to Path Traversal
Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Netty Redis Codec Encoder has a CRLF Injection Issue
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding
Netty has HttpClientCodec response desynchronization
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
Netty HTTP/3 QPACK literal unbounded allocation
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
Netty epoll transport denial of service via RST on half-closed TCP connection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.