Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersLiferay Portal Stores Password Reset Tokens in Plain Text
Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature
Keycloak TLS Client-Initiated Renegotiation Denial of Service
Apache Tomcat Vulnerable to Relative Path Traversal
Bouncy Castle Vulnerable to Uncontrolled Resource Consumption
Keycloak does not invalidate sessions when "Remember Me" is disabled
Keycloak does not invalidate offline sessions when the offline_access scope is removed
Liferay Portal and DXP do not properly restrict access to OpenAPI
Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
Liferay Portal fails to verify messages from the cluster network is trusted
Apache Syncope allows malicious administrators to inject Groovy code
ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature
Mammoth is vulnerable to Directory Traversal
Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages
Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection
GeoIP processor disables SSL certificate validation when downloading databases
OpenSearch Data Prepper uses deprecated SSL protocol identifier
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
PowerJob has Missing Authorization in its /user/list file
Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability
Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.