High
CVE-2026-69220
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filters
High
CVE-2026-55839
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
High
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
Medium
CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
High
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
High
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
Medium
CVE-2026-59903
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
High
CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler
High
CVE-2026-55153
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
High
CVE-2026-53660
OpenAM Insecure SSO Cookie Initialization
High
CVE-2026-8798
Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound
Medium
CVE-2026-56818
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
Medium
CVE-2026-71497
jsoup: Cleaner may expose markup with custom raw-text elements
Critical
CVE-2026-8763
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
Medium
CVE-2026-53573
core-geonetwork has an Open Redirect Bypass
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
High
CVE-2026-41695
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
Medium
CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Medium
CVE-2026-54704
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
High
CVE-2026-50559
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Medium
CVE-2026-54081
veraPDF Parser DoS via PostScript Type 1 Font Programs
Medium
CVE-2026-54080
veraPDF Parser DoS via PostScript CMap Streams
Medium
CVE-2026-54082
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
High
CVE-2026-54078
veraPDF Validation XXE via Rich Text
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.