Critical
CVE-2026-40860
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filters
High
CVE-2026-40048
Camel-PQC Vulnerable to Deserialization of Untrusted Data
Medium
CVE-2026-7045
Dynamic-Datasource has an Injection vulnerability
High
CVE-2026-33524
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Critical
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
High
CVE-2026-6857
camel-infinispan Vulnerable to Deserialization of Untrusted Data
High
CVE-2026-41166
OpenRemote has Improper Access Control via updateUserRealmRoles function
High
CVE-2026-22753
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers
Low
CVE-2026-22746
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Medium
CVE-2026-22747
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Critical
CVE-2026-32613
Spinnaker: RCE via expression parsing due to unrestricted context handling
Critical
CVE-2026-32604
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Critical
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
High
CVE-2026-41883
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
Medium
CVE-2026-41245
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Medium
CVE-2026-34164
Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Critical
CVE-2026-40478
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Critical
CVE-2026-40477
Improper restriction of the scope of accessible objects in Thymeleaf expressions
High
CVE-2026-40882
OpenRemote has XXE in Velbus Asset Import
Medium
CVE-2026-40942
Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
Medium
CVE-2026-40939
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
High
CVE-2026-2332
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Medium
CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unavailability
Medium
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in page history compare
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.