Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filtersMS Basic Cross-site Scripting vulnerability
Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning
Apache Hive Code Injection vulnerability
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
Jenkins Script Security Plugin sandbox bypass vulnerability
Wildfly vulnerable to denial of service
Jenkins Git server Plugin does not perform a permission check
Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext
Jenkins Subversion Partial Release Manager Plugin programmatically disables the fix for CVE-2016-3721
Apache ActiveMQ's default configuration doesn't secure the API web context
XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
Quarkus: authorization flaw in quarkus resteasy reactive and classic
Jberet: jberet-core logging database credentials
Quarkus: security checks in resteasy reactive may trigger a denial of service
OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)
OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
JADX file override vulnerability
Ant Media Server vulnerable to a local privilege escalation
Apache HugeGraph-Server: Command execution in gremlin
Apache HugeGraph-Server: Bypass whitelist in Auth mode
Apache HugeGraph-Hubble: SSRF in Hubble connection page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.