Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersApache StreamPark: FreeMarker SSTI RCE Vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Apache Linkis DataSource remote code execution vulnerability
Undertow Missing Release of Memory after Effective Lifetime vulnerability
Undertow Denial of Service vulnerability
Remote Code Execution (RCE) vulnerability in geoserver
Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
GeoServer's Server Status shows sensitive environmental variables and Java properties
DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
Keycloak leaks configured LDAP bind credentials through the Keycloak admin console
Undertow's url-encoded request path information can be broken on ajp-listener
CrateDB has a Client initialized Session-Renegotiation DoS
Apache Submarine Server Core has a SQL Injection Vulnerability
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core.
Keycloak's admin API allows low privilege users to use administrative functions
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
Ant Media Server does not properly authorize non-administrative API calls
Apache Hive Code Injection vulnerability
Jenkins Git server Plugin does not perform a permission check
OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.