LI
Vendor
Lightbend
21
CVEs
0
On KEV
0
New 30D
Products
PF9.8
Play Framework
Lightbend
11 CVEs0 on KEV0 new
AH7.5
Akka Http
Lightbend
3 CVEs0 on KEV0 new
SP7.5
Spray-json
Lightbend
2 CVEs0 on KEV0 new
AK9.1
Akka
Lightbend
1 CVEs0 on KEV0 new
AA7.5
Akka Actor
Lightbend
1 CVEs0 on KEV0 new
AD7.5
Akka Discovery
Lightbend
1 CVEs0 on KEV0 new
AM6.5
Akka Management
Lightbend
1 CVEs0 on KEV0 new
AK5.5
Alpakka Kafka
Lightbend
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-46548 | AM Akka Management Lightbend | 6.5 | Jun 3 | Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effective |
| CVE-2023-33251 | AH Akka Http Lightbend | 5.5 | May 21 | When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by… |
| CVE-2023-31442 | AD Akka Discovery Lightbend | 7.5 | May 11 | In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving… |
| CVE-2023-29471 | AK Alpakka Kafka Lightbend | 5.5 | Apr 27 | Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured) |
| CVE-2022-31023 | PF Play Framework Lightbend | 7.5 | Jun 2 | Play Framework is a web framework for Java and Scala |
| CVE-2022-31018 | PF Play Framework Lightbend | 7.5 | Jun 2 | Play Framework is a web framework for Java and Scala |
| CVE-2021-23339 | AK Akka-http Lightbend | 6.5 | Feb 17 | This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core |
| CVE-2020-28923 | PF Play Framework Lightbend | 2.7 | Dec 3 | An issue was discovered in Play Framework 2.8.0 through 2.8.4 |
| CVE-2020-27196 | PF Play Framework Lightbend | 7.5 | Nov 6 | An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2 |
| CVE-2020-26883 | PF Play Framework Lightbend | 7.5 | Nov 6 | In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents |
| CVE-2020-26882 | PF Play Framework Lightbend | 7.5 | Nov 6 | In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input |
| CVE-2020-12480 | PF Play Framework Lightbend | 6.5 | Aug 17 | In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed |
| CVE-2019-17598 | PF Play Framework Lightbend | 7.5 | Nov 5 | An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23 |
| CVE-2018-18854 | SP Spray-json Lightbend | 7.5 | Oct 31 | Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many… |
| CVE-2018-18853 | SP Spray-json Lightbend | 7.5 | Oct 31 | Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a… |
| CVE-2018-16131 | AH Akka Http Lightbend | 7.5 | Aug 30 | The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service… |
| CVE-2018-16115 | AK Akka Lightbend | 9.1 | Aug 29 | Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error |
| CVE-2018-13864 | PF Play Framework Lightbend | 7.5 | Jul 17 | A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows |
| CVE-2014-3630 | PF Play Framework Lightbend | 9.8 | Dec 29 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files,… |
| CVE-2015-2156 | PF Play Framework Lightbend | 7.5 | Oct 18 | Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to… |