Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filtersApache Polaris has an Improper Input Validation issue
Apache Polaris has an Improper Input Validation Issue
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read
Keycloak has a Forced Browsing issue
Spring Boot accepts predictable temp directory without ownership verification
Spring Boot's PID file write follows symlinks at predictable default path
Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
Apache Camel has an incomplete fix for CVE-2025-27636
Apktool: Path Traversal to Arbitrary File Write
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
OpenRemote has Improper Access Control via updateUserRealmRoles function
OpenRemote has XXE in Velbus Asset Import
Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Expression Injection in OpenRemote
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection
PowerJob vulnerable to SQL injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.