Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,280
Reset filtersCedarJava has policy injection vulnerability
CedarJava has type confusion vulnerability
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
Armeria: External Control of File Name or Path in xDS SDS DataSource
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables
JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
Karate Mock Server RCE via embedded expression evaluation of request-derived data
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
Netty: Wrapping plain trust manager silently disables hostname verification
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing
ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.