Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersKeycloak: Application-Level DoS via Scope Processing
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Undertow is Vulnerable to HTTP Request/Response Smuggling
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
Spring MVC and WebFlux has Server Sent Event stream corruption
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Apache Spark: Spark History Server Code Execution Vulnerability
Apache Livy: Restrict file access
Apache Livy: Unauthorized directory access
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.