Critical
CVE-2026-103922
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filters
High
CVE-2026-61586
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
High
CVE-2026-89425
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
High
CVE-2026-89407
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
High
CVE-2026-91777
jackson-databind quadratic forward-reference completion
High
CVE-2026-91776
jackson-databind retains every unknown raw type ID
Medium
CVE-2026-83557
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
High
CVE-2026-68497
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Medium
CVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Medium
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
Critical
CVE-2026-61741
http4s-scala-xml has an XML External Entity (XXE) processing issue
High
CVE-2026-61814
Jawn: Quadratic parsing effort in AsyncParser
High
CVE-2026-59990
Jawn: Uncontrolled nesting depth in JSON parser
Medium
CVE-2026-77421
JLine: ReDoS in Nano Editor Regex Search Mode
High
CVE-2026-77422
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
Medium
CVE-2026-77420
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
Critical
CVE-2026-85724
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
Medium
CVE-2026-69190
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Medium
CVE-2026-65829
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
High
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
High
CVE-2026-85058
io.moquette:moquette-broker has a Missing Authorization issue
Critical
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
High
CVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.