High
CVE-2026-11745
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filters
Critical
CVE-2026-11746
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Medium
CVE-2026-11748
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
Critical
CVE-2026-84939
Apache FreeMarker template loading mechanism vulnerable to path traversal
High
CVE-2026-55864
GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool
Critical
CVE-2026-75595
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Medium
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
High
CVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
Medium
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege esca
High
CVE-2026-84218
jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input
Medium
CVE-2026-55860
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Medium
CVE-2026-55859
org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
Medium
CVE-2026-55858
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context
Medium
CVE-2026-55857
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
Medium
CVE-2026-55856
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
High
CVE-2026-55848
MapFish Print has XXE that allows reading arbitrary files of certain types
Medium
CVE-2026-55867
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
High
CVE-2026-55841
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
High
CVE-2026-55673
PowSyBl Core has Command Injection in LocalCommandExecutor-s
High
CVE-2026-55175
Spinnaker: Improper yaml processing on kustomize bake operations
Medium
CVE-2026-55425
Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields
Medium
CVE-2026-55566
Yamcs has DOM XSS in Extension Routing
Critical
CVE-2026-55565
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
Critical
CVE-2026-55559
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.