Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersJava-SDK has a DNS Rebinding Vulnerability
Apache Cassandra has sensitive Information Leak in cqlsh
Apache Cassandra has an authenticated DoS over CQL
Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator
OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Apache ActiveMQ: Improper validation and restriction of a classpath path name
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers
Keycloak: Replay of action tokens via improper handling of single-use entries
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
Keycloak: Application-Level DoS via Scope Processing
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities
Undertow is Vulnerable to HTTP Request/Response Smuggling
Undertow is Vulnerable to HTTP Request/Response Smuggling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.