Critical
CVE-2026-68525
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,280
Reset filters
Medium
CVE-2026-54050
Sakai Profile Image Deletion has an IDOR
High
CVE-2026-54049
Sakai Conversations has a Stored XSS Issue
High
CVE-2026-66908
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Critical
CVE-2026-66906
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
High
CVE-2026-66907
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Medium
CVE-2026-60093
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
Medium
CVE-2026-63621
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
Medium
CVE-2026-59230
Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled
Critical
CVE-2026-76904
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Medium
CVE-2026-61799
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
High
CVE-2026-61798
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
High
CVE-2026-54251
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
High
CVE-2026-75140
jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations
High
CVE-2024-45747
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
High
CVE-2026-53966
XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing
Critical
CVE-2026-18963
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Low
CVE-2026-61634
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
Medium
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
High
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.