Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersCC-Tweaked has an SSRF Protection Bypass with NAT64
QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability
Apache Ignite REST API Has a Relative Path Traversal Vulnerability
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input
Keycloak has Insufficient Session Expiration
Keycloak has an Out-of-bounds Read
Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition
Keycloak Vulnerable to Incorrect Authorization
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Jenkins Active Directory Plugin follows LDAP referrals by default
Jenkins LDAP Plugin deserializes data from LDAP referrals without validation
Jenkins LDAP Plugin follows LDAP referrals
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery
Apache CXF has an LDAP injection vulnerability
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode
GlassFish's gadget handler is vulnerable to RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.