Low
CVE-2026-0976
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filters
High
CVE-2026-22244
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Critical
CVE-2025-12543
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Medium
CVE-2025-68280
Apache SIS has Improper Restriction of XML External Entity Reference vulnerability
High
CVE-2026-21452
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Medium
CVE-2025-15022
Vaadin vulnerable to Cross-site Scripting
High
CVE-2025-66518
Apache Kyuubi Server vulnerable to Path Traversal
Medium
CVE-2025-13467
Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization
High
CVE-2025-66524
Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization
Medium
CVE-2025-68161
Apache Log4j does not verify the TLS hostname in its Socket Appender
High
CVE-2024-29371
jose4j is vulnerable to DoS via compressed JWE content
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Medium
CVE-2025-67735
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
High
CVE-2025-67721
aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
High
CVE-2025-26866
Apache HugeGraph-Server: RAFT and deserialization vulnerability
Medium
CVE-2025-14518
PowerJob has a server-side request forgery vulnerability in PingPongUtils.java
Medium
CVE-2025-67638
Jenkins's build authorization token is stored and displayed in plain text
High
CVE-2025-66473
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
Medium
CVE-2025-11222
Central Dogma's Login Function Has an Open Redirect Vulnerability
High
CVE-2024-3884
Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
Low
CVE-2025-10939
Keycloak unable to restrict access to the admin console
Medium
CVE-2025-11538
Keycloak has debug default bind address
High
CVE-2025-14874
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
High
CVE-2025-62728
Hive Metastore Server is vulnerable to SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.