Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersApache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
Acknowledgement extension out of memory
Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache
Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
Micrometer gRPC server instrumentation DoS
Micrometer HTTP server instrumentations DoS
Netty has Insufficient Bailiwick Validation for NS Records
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
Netty's Default QUIC token handler accepts any client-supplied token
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Netty has Unbounded Direct Memory Consumption in its RedisDecoder
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
hsweb-framework has an open redirect issue
Logback vulnerable to Object Injection through HardenedObjectInputStream modules
Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component
Apache MINA SSHD bundle sshd-git has a path traversal vulnerability
Apache ActiveMQ server has an incomplete authorization workflow
Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.