High
CVE-2026-69208
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filters
Critical
CVE-2026-11746
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Medium
CVE-2026-11748
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
Medium
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
High
CVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
High
CVE-2026-84218
jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input
Medium
CVE-2026-55566
Yamcs has DOM XSS in Extension Routing
Critical
CVE-2026-55565
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
Critical
CVE-2026-55559
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
High
CVE-2026-55552
Yamcs has Unauthenticated Directory Traversal
Medium
CVE-2026-55549
Yamcs has Reflected XSS in the URL of the Authorize Endpoint
Medium
CVE-2026-55548
Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Medium
CVE-2026-55547
Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Critical
CVE-2026-55511
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
High
CVE-2026-54550
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
Medium
CVE-2026-54050
Sakai Profile Image Deletion has an IDOR
Critical
CVE-2026-71300
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
High
CVE-2026-66908
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Critical
CVE-2026-66906
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Medium
CVE-2026-60093
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
High
CVE-2026-75140
jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations
Critical
CVE-2026-18963
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.