Critical
CVE-2026-47323
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filters
High
CVE-2026-7507
Keycloak: Session fixation in OIDC login flow that can lead to account takeover
High
CVE-2026-7571
Keycloak: Access token disclosure and implicit flow bypass via forged client data
High
CVE-2026-7307
Keycloak: Denial of Service via specially crafted SAML input
High
CVE-2026-45300
async-http-client: Cookie header not stripped on cross-origin redirect
High
CVE-2026-45609
Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
High
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure
Critical
CVE-2026-27478
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
High
CVE-2026-44516
Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
High
CVE-2026-42587
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
High
CVE-2026-42582
Netty HTTP/3 QPACK literal unbounded allocation
Medium
CVE-2026-42581
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
High
CVE-2026-42579
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
Low
CVE-2026-42578
Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
Low
ghsa-22vx-2x23-98w6
OpenSearch vulnerable to improper authorization for Rollover Requests
High
CVE-2026-42577
Netty epoll transport denial of service via RST on half-closed TCP connection
Critical
CVE-2026-42555
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
High
ghsa-mggx-p7jf-jgw4
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
High
CVE-2026-42198
pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
High
CVE-2026-7412
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
Medium
CVE-2026-41417
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
Medium
CVE-2026-42333
quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
High
CVE-2026-42440
Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.