Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filtersBeetl's SpELFunction extension function has an expression injection risk
Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client
Apache Flink: Remote code execution via SQL injection in code generation
epa4all-client: TLS Certificate Validation Disabled in Production
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading
Apache Commons Configuration: StackOverflowError for YAML input with cycles
Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Apache Tomcat - AJP secret compared in non-constant time
Apache Tomcat - Digest authenticator will authenticate any unknown user
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Apache Tomcat - Security constraints not correctly applied
Apache Tomcat - WebSocket authentication header exposure
Apache Tomcat - HTTP/2 request headers not validated
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.