Critical
CVE-2026-48204
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filters
High
CVE-2026-46457
Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
Critical
CVE-2026-46454
Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Critical
CVE-2026-54617
LaunchServer FileServerHandler has an unauthenticated path traversal issue
Low
ghsa-j6hm-v3x2-qv6j
land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
Low
CVE-2026-49989
CrateDB's Blob HTTP handler bypasses authorization
Low
CVE-2026-48791
Sigstore Java has a vulnerability with bundle verification of integratedTime
High
CVE-2026-45794
OpenAM has Unsafe Java Deserialization via SNS
High
CVE-2026-45048
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
Low
CVE-2026-44793
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
Critical
CVE-2026-56120
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Medium
CVE-2026-55846
Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
Medium
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
High
CVE-2026-56740
JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables
High
CVE-2026-56741
JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
High
ghsa-2c85-rfcc-g74j
Karate Mock Server RCE via embedded expression evaluation of request-derived data
High
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
Critical
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
High
CVE-2026-55760
handlebars.java FileTemplateLoader Path Traversal
High
CVE-2026-50011
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
High
CVE-2026-48748
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
High
ghsa-j9gf-vw2f-9hrw
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
High
ghsa-9wcp-79g5-5c3c
Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators
High
CVE-2025-52465
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.