Open Source Vulnerabilities

wildfly, wildfly

vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routi...

wildfly, wildfly

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis

wildfly, wildfly

further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untru...

wildfly, wildfly

flaw was found in Undertow

wildfly, wildfly

flaw was found in Undertow

wildfly, wildfly

flaw was found in Undertow

wildfly, wildfly

Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit

sonarqube

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor

sonarqube, wildfly, wildfly

In Eclipse Parsson published Maven Central artifacts before version 1

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

spark-sc213-jdk17-py312

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings

spark-sc213-jdk17-py312

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings

spark-sc213-jdk17-py312

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas

spark-sc213-jdk17-py312

Connect2id Nimbus JOSE + JWT 10

spark-sc213-jdk17-py312

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

spark-sc213-jdk17-py312

Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor

spark-sc213-jdk17-py312

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor

spark-sc213-jdk17-py312

Netty is an asynchronous, event-driven network application framework

golang.org/x/text, rootio-golang.org/x/text

CVE-2026-56851 in golang.org/x/text - Patched by Root

golang.org/x/text, rootio-golang.org/x/text

CVE-2026-56852 in golang.org/x/text - Patched by Root

storybook

TuxCare security update for storybook (2 CVEs)

spark-sc213-jdk17-py312

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312

Netty is an asynchronous, event-driven network application framework

sonarqube, spark-sc213-jdk17-py312, spark-sc213-jdk17-py312

Netty is an asynchronous, event-driven network application framework

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

spark-sc213-jdk17-py312

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312

flaw was found in Netty

spark-sc213-jdk17-py312

flaw was found in Netty's HTTP/2 codec

go-fips-1.26, go-fips-1.26

When using http

dompurify

TuxCare security update for dompurify (1 CVE)

openjdk21

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization)

sonarqube, sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube, sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n...

sonarqube

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130)

tools.jackson.core:jackson-databind

TuxCare security update for tools.jackson.core:jackson-databind (6 CVEs)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube

OGNL is an Object Graph Navigation Library for Java

sonarqube

Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s...

sonarqube

Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks

opentelemetry-collector-contrib

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery

kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, opentelemetry-collector-contrib

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints