Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filtersAbsent Input Validation in BinaryHttpParser
The OpenSearch reporting plugin improperly controls tenancy access to reporting resources
Apache StreamPark: FreeMarker SSTI RCE Vulnerability
Apache StreamPark: Information leakage vulnerability
Eclipse Parsson stack overflow when parsing deeply nested input
Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes.
Apache StreamPark: maven build params could trigger remote command execution
Apache StreamPark: Unchecked maven build params could trigger remote command execution
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration.
Apache Linkis DataSource's JDBC Datasource Module with DB2 has JNDI Injection vulnerability
Apache Linkis DataSource allows arbitrary file reading
Apache Linkis DataSource remote code execution vulnerability
Apache Wicket: Remote code execution via XSLT injection
OpenSearch Observability does not properly restrict access to private tenant resources
Silverpeas Core Cross-site Scripting vulnerability
Spring Cloud Function Framework vulnerable to Denial of Service
Undertow Missing Release of Memory after Effective Lifetime vulnerability
Undertow Denial of Service vulnerability
Apache NiFi vulnerable to Cross-site Scripting
Apache Tomcat - Denial of Service
Remote Code Execution (RCE) vulnerability in geoserver
Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.