Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,280
Reset filtersKestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
Http4s Ember HTTP/2: unbounded continuation frame accumulation
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
Http4s Ember HTTP/2 has an unbounded outbound frame queue
Http4s: DigestAuth nonce map grows unbounded
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
Http4s Ember HTTP/2: unbounded inbound body buffering
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
Apache FreeMarker template loading mechanism vulnerable to path traversal
GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.