Medium
CVE-2026-48040
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filters
Medium
CVE-2026-41001
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration
Medium
CVE-2026-40992
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Medium
CVE-2026-41706
Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache
High
CVE-2026-40993
Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository
Medium
CVE-2026-41697
Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference
Low
CVE-2026-41848
Spring Framework Denial of Service via AntPathMatcher
High
CVE-2026-44894
Netty's Default QUIC token handler accepts any client-supplied token
High
CVE-2026-47695
CC-Tweaked has an SSRF Protection Bypass with NAT64
Medium
CVE-2026-9802
Keycloak has Insufficient Session Expiration
Critical
CVE-2026-46621
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Critical
CVE-2026-46562
Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override
Medium
CVE-2026-48919
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Medium
CVE-2026-48918
Jenkins Active Directory Plugin follows LDAP referrals by default
Medium
CVE-2026-44596
Yamcs has No Rate Limiting on Authentication Endpoint
Medium
CVE-2026-44595
Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints
Medium
CVE-2026-42568
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
Critical
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Low
CVE-2026-48589
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Medium
CVE-2026-41863
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk
Low
CVE-2026-9370
jasypt-spring-boot Uses a One-Way Hash without a Salt
High
CVE-2026-45799
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
High
ghsa-xm96-gfjx-jcrc
ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation
Medium
CVE-2026-45581
fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.