Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,120
Reset filtersNerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
Snappier has an infinite loop during SnappyStream decompression with malformed framed input
OpAMP client reads unbounded HTTP response bodies
YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`
YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
OneCollector exporter reads unbounded HTTP response bodies
OpenTelemetry.Resources.Azure has an unbounded HTTP response body read
OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure
ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling
OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle
MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path
Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment
Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
MsQuic has a Remote Elevation of Privilege Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.