Critical
CVE-2026-27641
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Critical
CVE-2026-27614
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Medium
ghsa-mhc9-48gj-9gp3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
Medium
CVE-2026-27645
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
High
CVE-2026-27696
changedetection.io is Vulnerable to SSRF via Watch URLs
High
ghsa-mxhj-88fx-4pcv
Fickling: OBJ opcode call invisibility bypasses all safety checks
Medium
CVE-2026-27156
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Low
CVE-2026-23983
Apache Superset allows authenticated users to view sensitive data without explicit permissions
High
CVE-2026-23982
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
CVE-2026-23984
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Medium
CVE-2026-23980
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
CVE-2026-23969
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
High
CVE-2026-27483
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Medium
CVE-2026-27482
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Medium
CVE-2026-27199
Werkzeug safe_join() allows Windows special device names
Low
CVE-2026-27205
Flask session does not add `Vary: Cookie` header when accessed in some ways
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
Critical
CVE-2026-26030
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Medium
CVE-2026-25739
Indico Affected by Cross-Site-Scripting via material uploads
Medium
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple places
Medium
CVE-2026-25527
changedetection.io is vulnerable to unauthenticated static path traversal
Medium
CVE-2026-24126
Weblate has an argument injection in management console
Critical
CVE-2025-14009
NLTK has a Zip Slip Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.