Mittel
CVE-2026-55549
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 7.071
Filter zurücksetzen
Mittel
CVE-2026-55548
Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Mittel
CVE-2026-55547
Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Mittel
CVE-2026-55545
Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce
Hoch
CVE-2026-55521
Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities
Kritisch
CVE-2026-55511
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Kritisch
CVE-2026-47892
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
Kritisch
CVE-2026-47890
Spring Framework Server Sent Event stream corruption while rendering fragments
Kritisch
CVE-2026-47884
Spring Framework Improper Path Limitation in XsltView
Mittel
CVE-2026-55688
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
Hoch
CVE-2026-54550
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
Hoch
CVE-2026-54556
http4s has HTTP/2 Denial of Service with Ember Backend
Kritisch
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
Kritisch
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Kritisch
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
Mittel
CVE-2026-54050
Sakai Profile Image Deletion has an IDOR
Hoch
CVE-2026-54049
Sakai Conversations has a Stored XSS Issue
Kritisch
CVE-2026-78329
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Kritisch
CVE-2026-71300
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
Hoch
CVE-2026-66908
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Kritisch
CVE-2026-66906
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Hoch
CVE-2026-66907
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Mittel
CVE-2026-60093
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
Mittel
CVE-2026-63621
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.