High
CVE-2026-50270
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 361
Reset filters
High
CVE-2026-44891
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
High
CVE-2026-59955
Apollo ConfigService access key authentication bypass via raw config file appId parsing
High
CVE-2026-59954
Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
High
CVE-2026-49485
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
High
CVE-2026-54640
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Medium
CVE-2026-56139
Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
Medium
CVE-2026-49365
Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
Medium
CVE-2026-49099
Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter
Critical
CVE-2026-56140
Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy
High
CVE-2026-42527
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
High
CVE-2026-43866
Apache Camel JMS deserialization filter bypass
Low
ghsa-j6hm-v3x2-qv6j
land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
High
CVE-2026-57303
Jenkins Assembla Plugin has an XXE vulnerability
Medium
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Medium
CVE-2026-100725
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
High
ghsa-m4w9-hjfw-vwj4
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
Medium
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Medium
CVE-2026-55414
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
High
CVE-2026-56741
JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
Critical
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
High
CVE-2026-55470
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
High
CVE-2026-55405
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
High
CVE-2026-50010
Netty: Wrapping plain trust manager silently disables hostname verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.