Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersApache Seata Vulnerable to Deserialization of Untrusted Data
jackson-core can throw a StackoverflowError when processing deeply nested data
Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information
Xuxueli XXL-SSO Cross-site Scripting vulnerability
XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument
Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Quarkus potentially leaks data when duplicating a duplicated context
sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+
Crafter Studio Groovy Sandbox Bypass
PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion
PowSyBl Core contains Polynomial REDoS’es
PowSyBl Core allows deserialization of untrusted SparseMatrix data
PowSyBl Core XML Reader allows XXE and SSRF
Apache SeaTunnel: Unauthenticated insecure access
Apache Tomcat - Security constraint bypass for pre/post-resources
Apache Tomcat - DoS in multipart upload
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
Apache Tomcat installer for Windows has an untrusted search path vulnerability
Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler
Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session
Liferay Portal does not limit the depth of a GraphQL queries
XWiki does not require right warnings for XClass definitions
XWiki allows remote code execution through preview of XClass changes in AWM editor
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.