Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersElasticsearch Incorrect Authorization vulnerability
Databricks JDBC Driver Command Injection vulnerability
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Uncontrolled Resource Consumption vulnerability
Welcome and About GeoServer pages communicate version and revision information
Ucum-java has an XXE vulnerability in XML parsing
XWiki allows remote code execution through the extension sheet
XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
http4k has a potential XXE (XML External Entity Injection) vulnerability
XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
XWiki allows RCE from script right in configurable sections
io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling
Apache Struts file upload logic is flawed
sigstore-java has a vulnerability with bundle verification
Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Spring LDAP data exposure vulnerability
Apache Ozone: Improper authentication when generating S3 secrets
AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Ant-Media-Server vulnerable to Improper Output Neutralization for Logs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.