High
CVE-2026-44241
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,601
Reset filters
Low
CVE-2026-44242
Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header
Medium
CVE-2026-43975
Apache Wicket has a Path Traversal issue
Critical
CVE-2026-44221
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
High
ghsa-mggx-p7jf-jgw4
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
High
CVE-2026-42198
pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
Low
CVE-2026-42188
Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
Medium
CVE-2026-42140
XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter
Critical
CVE-2026-7411
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
High
CVE-2026-7412
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
Medium
CVE-2026-41417
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
Medium
CVE-2026-42333
quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
Critical
CVE-2026-41901
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
Critical
CVE-2026-41258
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Critical
CVE-2026-42809
Apache Polaris has an Improper Input Validation Issue
Critical
CVE-2026-40682
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
Critical
CVE-2026-40076
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
High
CVE-2026-39852
Quarkus has Authentication/Authorization bypasses
High
CVE-2026-40075
OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read
High
ghsa-h8cj-hpmg-636v
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
Medium
CVE-2026-22740
Spring Framework DoS with Multipart Temp Files in WebFlux
Low
CVE-2026-40969
Spring gRPC AuthenticationException messages are reflected to remote client
High
CVE-2026-40973
Spring Boot accepts predictable temp directory without ownership verification
Medium
CVE-2026-40970
Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.