High
CVE-2026-39973
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filters
Critical
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Medium
CVE-2026-30139
Silverpeas Core has a reflected cross-site scripting vulnerability
High
CVE-2026-6857
camel-infinispan Vulnerable to Deserialization of Untrusted Data
High
CVE-2026-41166
OpenRemote has Improper Access Control via updateUserRealmRoles function
High
CVE-2026-40542
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Medium
CVE-2026-22748
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
High
CVE-2026-22753
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers
High
CVE-2026-22754
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules
Low
CVE-2026-22746
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Medium
CVE-2026-22747
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Medium
CVE-2026-22751
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Critical
CVE-2026-32613
Spinnaker: RCE via expression parsing due to unrestricted context handling
Critical
CVE-2026-32604
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Medium
CVE-2026-33558
Apache Kafka exposes sensitive information in its DEBUG logs
Critical
CVE-2026-33557
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
Critical
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
Medium
CVE-2026-0636
Bouncy Castle has an LDAP injection
High
CVE-2026-5598
Bouncy Castle Has Covert Timing Channel Vulnerability
High
CVE-2026-3505
Bouncy Castle Uncontrolled Resource Consumption vulnerability
High
CVE-2026-40458
PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
High
CVE-2026-41883
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
Medium
CVE-2026-41245
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
Medium
CVE-2026-34164
Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.