Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersPowerJob has a server-side request forgery vulnerability in PingPongUtils.java
Improper Memory Cleanup in the Okta Java SDK
Jenkins is missing a permission check on password fields
Jenkins's build authorization token is stored and displayed in plain text
Jenkins's build authorization token is stored and displayed in plain text
Jenkins has a Denial of service vulnerability in HTTP-based CLI
Jenkins has a CSRF vulnerability on the login form
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
Robocode has an insecure temporary file creation vulnerability in the AutoExtract component
Robocode vulnerable to Directory Traversal in recursivelyDelete Method
JDA (Java Discord API) downloads external URLs when updating message components
yawkat LZ4 Java has a possible information leak in Java safe decompressor
Apache Tika has XXE vulnerability
Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function
BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
XWiki Jetty Package (XJetty) allows accessing any application file through URL
NutzBoot Incorrect Privilege Assignment vulnerability
NutzBoot vulnerable to information disclosure
NutzBoot vulnerable to deserialization
ThingsBoard allows an authenticated user to upload malicious SVG images
Apache Druid’s Kerberos authenticator uses a weak fallback secret
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.