Critical
CVE-2026-54617
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 278
Reset filters
High
CVE-2026-53712
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms
High
CVE-2026-39379
GeoNetwork has reflected XSS through client-side template injection
Medium
CVE-2026-57285
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Medium
CVE-2026-44202
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Critical
CVE-2026-44179
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Medium
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Medium
CVE-2026-100725
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
Medium
CVE-2026-100724
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
High
CVE-2026-55772
CedarJava has type confusion vulnerability
Critical
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Medium
CVE-2026-54697
ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing
High
ghsa-j9gf-vw2f-9hrw
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
Medium
CVE-2026-53698
Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set
Medium
CVE-2026-47838
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
High
CVE-2026-44894
Netty's Default QUIC token handler accepts any client-supplied token
Critical
CVE-2026-46621
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Critical
CVE-2026-44632
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
High
CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
High
CVE-2026-35194
Apache Flink: Remote code execution via SQL injection in code generation
Medium
CVE-2026-45292
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Critical
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
High
CVE-2026-41713
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
High
CVE-2026-39816
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.