Medium
CVE-2026-59919
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filters
Medium
CVE-2026-59900
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Medium
CVE-2026-59899
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
High
CVE-2026-56822
Netty: TOCTOU in OcspServerCertificateValidator
High
CVE-2026-56821
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-56817
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Medium
CVE-2026-56746
Netty: Security Control Bypass via CORS Short-Circuit Failure
High
CVE-2026-55833
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
High
CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded settings map
Medium
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
High
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Medium
ghsa-mhm7-754m-9p8w
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
Medium
CVE-2026-59888
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
High
CVE-2026-54291
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
High
CVE-2026-11400
AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
High
CVE-2026-67342
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
High
CVE-2026-67340
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
High
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
High
CVE-2026-54076
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
High
CVE-2026-54077
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
High
CVE-2026-50270
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-44891
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.