Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersApache Ranger has Stored Cross-site Scripting vulnerability in Edit Service Page
Apache CXF: Denial of Service vulnerability with temporary files
Elasticsearch allocation of resources without limits or throttling leads to crash
HAL Console has a Cross Site Scripting (XSS) vulnerability of user input
Insecure Temporary File in RESTEasy
Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability
XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing
Denial of Service in Keycloak Server via Security Headers
Keycloak allows unrestricted admin use of system and environment variables
jte's HTML templates containing Javascript template strings are subject to XSS
Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
Narayana deadlock via multiple join requests sent to LRA Coordinator
Apache NiFi: Missing Complete Authorization for Parameter and Service References
Amazon Redshift JDBC Driver vulnerable to SQL Injection
Apache MINA Deserialization RCE Vulnerability
Apache HugeGraph-Server: Fixed JWT Token (Secret)
Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment
Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Spring Framework Path Traversal vulnerability
QOS.CH logback-core Expression Language Injection vulnerability
QOS.CH logback-core Server-Side Request Forgery vulnerability
Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.