Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filtersepa4all-client has a VAU Signature bypass
bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption
Alkacon OpenCms is vulnerable to XSS via cmis-online/type
Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information
Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host
Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp
Spring Cloud Config Server Logged Sensitive Information
Spring Cloud Config Server Susceptible To TOCTOU Attack
Spring Cloud Config vulnerable to Path Traversal
Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
Netty MQTT: Resource exhaustion in MqttDecoder
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Netty Redis Codec Encoder has a CRLF Injection Issue
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding
Netty has HttpClientCodec response desynchronization
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
Netty HTTP/3 QPACK literal unbounded allocation
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.