Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersXWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
FASTJSON Includes Functionality from Untrusted Control Sphere
Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Bio-Formats has an XML External Entity (XXE) vulnerability
Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
Apache SIS has Improper Restriction of XML External Entity Reference vulnerability
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Vaadin vulnerable to Cross-site Scripting
Apache Kyuubi Server vulnerable to Path Traversal
Apache StreamPipes has Improper Privilege Management issue
Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization
Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization
Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation
Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data
Apache Log4j does not verify the TLS hostname in its Socket Appender
Amazon S3 Encryption Client for Java has a Key Commitment Issue
jose4j is vulnerable to DoS via compressed JWE content
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.