High
ghsa-m4w9-hjfw-vwj4
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filters
Medium
CVE-2026-100724
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
Medium
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Medium
CVE-2026-55846
Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
High
CVE-2026-55773
CedarJava has policy injection vulnerability
High
CVE-2026-55772
CedarJava has type confusion vulnerability
Medium
CVE-2026-55414
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
Medium
CVE-2026-11752
Armeria: External Control of File Name or Path in xDS SDS DataSource
Medium
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
High
CVE-2026-56740
JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables
High
CVE-2026-56741
JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
High
ghsa-2c85-rfcc-g74j
Karate Mock Server RCE via embedded expression evaluation of request-derived data
Medium
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
High
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
Critical
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
High
CVE-2026-55470
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
High
CVE-2026-55760
handlebars.java FileTemplateLoader Path Traversal
High
CVE-2026-55405
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
High
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Medium
CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Medium
CVE-2026-41280
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
Medium
CVE-2026-42357
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Critical
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
Critical
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.