High
CVE-2026-67342
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filters
High
CVE-2026-67340
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
High
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
High
CVE-2026-54077
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
High
CVE-2026-50270
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-44891
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
Medium
CVE-2026-49833
DSpace: Path Traversal is possible through LDN message generation
Medium
CVE-2026-49830
DSpace: ORE resource URI does not validate scheme for non-web resources
Medium
CVE-2026-49831
DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path
High
CVE-2026-49832
DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN
High
CVE-2024-7768
H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
High
CVE-2026-34151
XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
Low
CVE-2023-41329
Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
Medium
CVE-2023-32732
gRPC connection termination issue
High
CVE-2026-62238
OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
High
CVE-2026-54640
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
High
CVE-2026-54641
OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
Medium
CVE-2026-56139
Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
Medium
CVE-2026-49365
Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
High
CVE-2026-55993
Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy
High
CVE-2026-55994
Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy
Critical
CVE-2026-48205
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
Critical
CVE-2026-53913
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Critical
CVE-2026-48203
Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.