Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersSpring Framework Improper Path Limitation with Script View Templates
HAPI FHIR HTTP authentication leak in redirects
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
Jenkins has a link following vulnerability allows arbitrary file creation
Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files
SQL Injection in Spring AI MariaDBFilterExpressionConverter
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Apache Spark: Spark History Server Code Execution Vulnerability
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Apache Livy: Restrict file access
Apache Livy: Unauthorized directory access
Keycloak vulnerable to authorization bypass via the Admin API
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
Keycloak: Information disclosure of disabled user attributes via administrative endpoint
Vaadin: Specially crafted ZIP archives can escape the intended extraction directory
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.