High
CVE-2026-55521
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 361
Reset filters
High
CVE-2026-54556
http4s has HTTP/2 Denial of Service with Ember Backend
Critical
CVE-2026-78329
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Medium
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
Medium
CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
High
CVE-2026-41695
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
Medium
CVE-2026-54704
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
High
CVE-2026-50559
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
High
CVE-2026-54078
veraPDF Validation XXE via Rich Text
High
CVE-2026-54079
veraPDF Validation XXE via XFA
Medium
CVE-2026-73508
Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
High
CVE-2026-56821
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
High
CVE-2026-55851
Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
High
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Medium
ghsa-mhm7-754m-9p8w
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
High
CVE-2026-54291
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
High
CVE-2026-67342
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.