Critical
CVE-2026-41586
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filters
Medium
CVE-2026-42525
Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability
High
CVE-2026-42524
Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
Medium
CVE-2026-42519
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Medium
CVE-2026-42521
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Critical
CVE-2026-42523
Jenkins GitHub Plugin has an XSS vulnerability
Medium
CVE-2026-42522
Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test
High
CVE-2026-42520
Jenkins Credentials Binding Plugin has a path traversal vulnerability
Low
CVE-2026-22741
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Medium
CVE-2026-22745
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources
Medium
CVE-2026-22740
Spring Framework DoS with Multipart Temp Files in WebFlux
Low
CVE-2026-7303
xxl-job has a Resource Injection issue
Medium
CVE-2026-40968
Spring gRPC SecurityContext leaks across requests upon authorization failure
Low
CVE-2026-40969
Spring gRPC AuthenticationException messages are reflected to remote client
Medium
CVE-2026-40966
Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
High
CVE-2026-40978
Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()
Medium
CVE-2026-40980
Spring AI Vulnerable to OOM by attacker-controlled PDF
Medium
CVE-2026-40979
Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory
High
CVE-2026-40967
Spring AI has a VectorStore FilterExpression Converter injection
High
CVE-2026-40973
Spring Boot accepts predictable temp directory without ownership verification
Critical
CVE-2026-40976
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
Medium
CVE-2026-40977
Spring Boot's PID file write follows symlinks at predictable default path
Medium
CVE-2026-40974
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Medium
CVE-2026-40975
Spring Boot's random value property source uses a weak PRNG unsuitable for secrets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.