Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersAlkacon OpenCMS stored cross-site scripting (XSS) vulnerability
OpenMetadata SQL Injection
Liferay Cross-site Scripting vulnerability
Unregistered users can see "public" messages from a closed wiki via notifications from a different wiki
jsonschema2pojo has Improper Restriction of Operations within the Bounds of a Memory Buffer
Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File
Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing
Apache Pulsar Kafka Connector Logs Sensitive Information in Application Logs
Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion
Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function
Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component
Jenkins Missing Permission Check
Jenkins Missing Permission Check
Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted
Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form
Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files
Jenkins Stack Hammer Plugin Stores API Keys Unencrypted in Job `config.xml` Files
Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted
Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution
Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)
jooby-pac4j: deserialization of untrusted data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.