Medium
CVE-2026-57295
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,280
Reset filters
Medium
CVE-2026-57285
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Medium
CVE-2026-57286
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Medium
CVE-2026-48480
OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
Medium
CVE-2026-54517
jackson-databind has @JsonView bypass for setterless creator properties
Medium
CVE-2026-54516
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Medium
CVE-2026-54515
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Medium
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
High
CVE-2026-54513
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
High
CVE-2026-54512
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
Medium
CVE-2026-54518
jackson-databind has a @JsonView bypass for unwrapped creator parameters
High
CVE-2026-45049
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
High
CVE-2026-45048
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
Low
CVE-2026-44793
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
Critical
CVE-2026-44203
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Medium
CVE-2026-44202
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Critical
CVE-2026-44179
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Medium
CVE-2026-54665
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Critical
CVE-2026-56120
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Medium
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Medium
CVE-2026-100725
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
High
ghsa-m4w9-hjfw-vwj4
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
Medium
CVE-2026-100724
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
Medium
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.