Medium
CVE-2026-54665
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,601
Reset filters
Medium
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Medium
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Medium
CVE-2026-55846
Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
High
CVE-2026-55772
CedarJava has type confusion vulnerability
Medium
CVE-2026-55414
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
Medium
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
High
CVE-2026-56740
JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables
High
CVE-2026-56741
JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
High
ghsa-2c85-rfcc-g74j
Karate Mock Server RCE via embedded expression evaluation of request-derived data
Critical
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
High
CVE-2026-55470
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Medium
CVE-2026-50560
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Medium
CVE-2026-50020
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
High
CVE-2026-50010
Netty: Wrapping plain trust manager silently disables hostname verification
Medium
CVE-2026-50009
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
High
CVE-2026-48748
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
Medium
CVE-2026-54697
ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing
Medium
CVE-2026-54700
ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation
High
ghsa-j9gf-vw2f-9hrw
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
High
ghsa-9wcp-79g5-5c3c
Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators
Medium
CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
High
CVE-2025-52465
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
High
CVE-2026-50629
Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.