Critical
CVE-2026-66906
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 310
Reset filters
Medium
CVE-2026-60093
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Medium
CVE-2026-61799
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
Low
CVE-2026-61634
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-55839
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Medium
CVE-2026-54712
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
Medium
CVE-2026-54081
veraPDF Parser DoS via PostScript Type 1 Font Programs
Medium
CVE-2026-54080
veraPDF Parser DoS via PostScript CMap Streams
High
CVE-2026-102695
OmniFaces: Forged combined-resource IDs and related output/push boundaries
High
CVE-2026-73507
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Medium
CVE-2026-59921
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
High
CVE-2026-55833
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
High
CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded settings map
High
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
High
CVE-2026-49464
NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
Medium
CVE-2026-49833
DSpace: Path Traversal is possible through LDN message generation
Medium
CVE-2026-49831
DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path
High
CVE-2026-42527
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.