Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersNeo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log
Neo4j Enterprise and Community vulnerable to a potential information disclosure
JinJava Bypass through ForTag leads to Arbitrary Java Execution
Crafter CMS has Improper Control of Dynamically-Managed Code Resources
H2O has an External Control of File Name or Path vulnerability
jsonrpc4j has Infinite Loop in RPC Stream Writer
Quick-Media Batik Codec FIX package has Code Injection vulnerability
Quick-Media Batik Codec FIX Package has Buffer Overflow Vulnerability in PNG Codec
weixin4j has Improperly Controlled Sequential Memory Allocation
Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion
Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods
Apache Continuum vulnerable to Command Injection through Installations REST API
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
Logback allows an attacker to instantiate classes already present on the class path
Apache Solr: Insufficient file-access checking in standalone core-creation requests
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)
Apache Linkis: Password Exposure
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass
risesoft-y9 Digital-Infrastructure has a SQL injection vulnerability
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability
Jervis's AES CBC Mode is Without Authentication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.