High
CVE-2026-42579
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filters
Low
CVE-2026-42578
Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
Low
ghsa-x5hg-x4gv-j98m
OpenSearch has ineffective TLS certificate hostname verification
Medium
ghsa-x83w-23jp-g6pw
OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation
Low
ghsa-22vx-2x23-98w6
OpenSearch vulnerable to improper authorization for Rollover Requests
Low
ghsa-83x9-vc3c-hghc
OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths
Medium
CVE-2026-44308
Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
Medium
ghsa-248h-974q-xrc2
axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
High
CVE-2026-42577
Netty epoll transport denial of service via RST on half-closed TCP connection
Critical
CVE-2026-42555
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
High
CVE-2026-44241
Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header
Low
CVE-2026-44242
Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header
Medium
CVE-2026-43975
Apache Wicket has a Path Traversal issue
High
CVE-2026-43646
Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Critical
CVE-2026-40010
Apache Wicket has a Session Fixation issue
Medium
CVE-2026-42509
Apache Wicket has a Cross-site Scripting issue
Critical
CVE-2026-44221
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
High
ghsa-mggx-p7jf-jgw4
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
High
CVE-2026-42198
pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
Low
CVE-2026-42188
Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
Medium
CVE-2026-42140
XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter
Critical
CVE-2026-7411
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
High
CVE-2026-7412
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
Medium
CVE-2026-41417
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.