Medium
CVE-2026-83557
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 65
Reset filters
High
CVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
High
CVE-2026-81875
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
Medium
CVE-2026-54081
veraPDF Parser DoS via PostScript Type 1 Font Programs
Medium
CVE-2026-54080
veraPDF Parser DoS via PostScript CMap Streams
Medium
CVE-2026-54082
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
High
CVE-2026-56822
Netty: TOCTOU in OcspServerCertificateValidator
High
CVE-2026-56821
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Medium
CVE-2025-32781
Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center
High
CVE-2026-49485
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
High
CVE-2026-54513
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
High
CVE-2026-54512
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
High
CVE-2026-55470
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Critical
CVE-2026-50627
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
High
CVE-2026-45367
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
High
CVE-2026-44900
epa4all-client has a VAU Signature bypass
High
CVE-2026-42579
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
Medium
CVE-2026-22748
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Critical
CVE-2026-33557
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
Critical
CVE-2026-34361
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Medium
CVE-2026-34360
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.