Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersOpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Apache ActiveMQ: Improper validation and restriction of a classpath path name
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities
Undertow is Vulnerable to HTTP Request/Response Smuggling
Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
Keycloak: manage-clients permission escalates to full realm admin access
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.