Critical
CVE-2026-66906
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,601
Reset filters
High
CVE-2026-66907
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Medium
CVE-2026-63621
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Medium
CVE-2026-61799
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
High
CVE-2026-61798
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
High
CVE-2026-54251
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
High
CVE-2024-45747
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
Medium
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
High
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
High
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
High
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
High
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
High
CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
High
CVE-2026-50559
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Medium
CVE-2026-54082
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
High
CVE-2026-54078
veraPDF Validation XXE via Rich Text
High
CVE-2026-54079
veraPDF Validation XXE via XFA
High
CVE-2026-43910
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Medium
CVE-2023-37465
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.