Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersSpring Cloud Gateway's SSL bundle configuration silently bypassed
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
Apache Tomcat has an Open Redirect vulnerability
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
Apache Tomcat has an Improper Input Validation vulnerability
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache Tomcat: Configured cipher preference order not preserved
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound
Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability
Apache OpenMeetings Uses Hard-coded Cryptographic Key
Apache DolphinScheduler vulnerable to sensitive information disclosure
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
Emissary has GitHub Actions Shell Injection via Workflow Inputs
PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection
PowerJob vulnerable to SQL injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.