High
CVE-2026-28367
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filters
High
CVE-2026-22744
Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters
High
CVE-2026-22742
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
High
CVE-2026-22743
Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter
Critical
CVE-2026-22738
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
Medium
CVE-2026-3121
Keycloak: manage-clients permission escalates to full realm admin access
Medium
CVE-2026-3190
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
High
CVE-2026-33871
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
High
CVE-2026-33870
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Critical
ghsa-h8w2-rv57-vc6f
splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution
Critical
CVE-2026-33728
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Low
CVE-2026-4874
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
High
CVE-2025-70952
pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names
Critical
CVE-2026-33701
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
High
CVE-2025-67030
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Medium
CVE-2026-32948
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Low
CVE-2026-32642
Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol
Medium
CVE-2026-3260
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
High
CVE-2026-22739
Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
Low
CVE-2026-4633
Keycloak's identity-first login flow exposes user information
Medium
CVE-2026-4628
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
Low
CVE-2026-22735
Spring MVC and WebFlux has Server Sent Event stream corruption
Critical
CVE-2026-22732
Spring Security HTTP Headers Are not Written Under Some Conditions
High
CVE-2026-22733
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.