Low
CVE-2025-11966
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filters
Medium
CVE-2025-11965
Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
Medium
CVE-2025-62249
Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget
Medium
CVE-2025-62250
Liferay Portal fails to verify messages from the cluster network is trusted
High
CVE-2025-57738
Apache Syncope allows malicious administrators to inject Groovy code
High
CVE-2025-47410
Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
Critical
CVE-2025-56316
MCMS vulnerable SQL injection via the content_title parameter
Medium
CVE-2025-34281
ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature
Medium
CVE-2025-10044
Keycloak error_description injection on error pages that can trigger phishing attacks
Critical
CVE-2025-11849
Mammoth is vulnerable to Directory Traversal
Medium
CVE-2025-41254
Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages
High
CVE-2025-41253
Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection
Medium
ghsa-3xgr-h5hq-7299
GeoIP processor disables SSL certificate validation when downloading databases
Medium
ghsa-28gg-8qqj-fhh5
OpenSearch Data Prepper uses deprecated SSL protocol identifier
High
CVE-2025-62371
OpenSearch Data Prepper plugins trust all SSL certificates by default
High
CVE-2025-59419
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
Medium
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.
High
CVE-2025-59250
JDBC Driver for SQL Server has improper input validation issue
Medium
CVE-2024-44088
Apache Geode web-api is vulnerable to Cross-site Scripting
Medium
CVE-2025-62251
Liferay has Incorrect Permission Assignment for Critical Resource
Medium
CVE-2025-62241
Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key
Medium
CVE-2025-62252
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
Medium
CVE-2025-62246
Liferay Mentions Web is Vulnerable to Cross-site Scripting
Medium
CVE-2025-62242
Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.