High
CVE-2026-46481
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filters
Medium
CVE-2026-9087
Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise
High
CVE-2026-45799
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
High
CVE-2026-6009
Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)
High
ghsa-xm96-gfjx-jcrc
ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation
Medium
CVE-2026-45581
fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode
Critical
CVE-2026-2586
GlassFish's Administration Console is Vulnerable to RCE
Critical
CVE-2026-2587
GlassFish's gadget handler is vulnerable to RCE
Critical
CVE-2026-47323
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
High
CVE-2026-7504
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
High
CVE-2026-7507
Keycloak: Session fixation in OIDC login flow that can lead to account takeover
High
CVE-2026-7571
Keycloak: Access token disclosure and implicit flow bypass via forged client data
Low
CVE-2026-7860
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability
Medium
CVE-2026-4630
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
High
CVE-2026-7307
Keycloak: Denial of Service via specially crafted SAML input
Medium
CVE-2026-37981
Keycloak Account Resources user lookup contains broken access control
Medium
CVE-2026-37982
Keycloak: Unauthorized account takeover via WebAuthn token replay
Medium
CVE-2026-37979
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Medium
CVE-2026-37978
Keycloak: Information Disclosure via evaluate-scopes Admin API
Medium
CVE-2026-8922
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured
Medium
CVE-2026-8830
Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation
High
CVE-2026-45367
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
High
CVE-2026-45300
async-http-client: Cookie header not stripped on cross-origin redirect
High
CVE-2026-45609
Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.