Critical
CVE-2026-50627
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filters
Medium
CVE-2026-50630
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection
High
CVE-2025-27511
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
High
CVE-2026-48059
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
Medium
CVE-2026-11986
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
Medium
CVE-2026-48043
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Medium
CVE-2026-48040
netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access
High
CVE-2026-48006
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
Medium
CVE-2026-41001
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration
High
CVE-2026-41856
Spring for GraphQL: Annotation Detection Vulnerability
High
CVE-2026-41699
Spring for GraphQL: Unsafe Deserialization
High
CVE-2026-41700
Spring for GraphQL: Cross-Site WebSocket Hijacking
High
CVE-2026-40999
Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations
High
CVE-2026-40994
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Medium
CVE-2026-40995
Spring Web Services: X.509 authentication bypasses Spring Security account checks
Low
CVE-2026-41000
Spring Web Services: WSS4J validation does not use configured replay cache
High
CVE-2026-40998
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Medium
CVE-2026-40996
Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Medium
CVE-2026-40997
Spring Web Services: SOAP security faults leak Spring Security account state
Medium
CVE-2026-40986
Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Medium
CVE-2026-40992
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
High
CVE-2026-40987
Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
Medium
CVE-2026-40985
Spring Web Flow has Data Binding Vulnerability with Unified EL Parser
Medium
CVE-2026-53698
Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.