A flaw was found in the json payload

A vulnerability was found in quarkus

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior

pgjdbc is the offical PostgreSQL JDBC Driver

A vulnerability was found in Quarkus in the quarkus-security-webauthn module

Quarkus: graphql operations over websockets bypass

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a…

A flaw was found in Quarkus

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks

Quarkus authorization bypass via semicolon path normalization inconsistency

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of…

Local privilege escalation through system temporary directory

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain

A flaw was found in Quarkus

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep…

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested…

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more…

Possible request smuggling in HTTP/2 due missing validation of content-length

Possible request smuggling in HTTP/2 due missing validation

Information disclosure through temporary directory permissions

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in…

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if…

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick…

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final

A flaw was found in Hibernate Validator version 6.1.2.Final

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that…

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory…