Low
CVE-2026-35193
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 307
Reset filters
Low
CVE-2026-8404
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Low
CVE-2026-7666
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Low
CVE-2026-6873
Django: signed cookies are vulnerable to salt namespace collisions
Low
CVE-2026-48587
Django: has_vary_header may expose cached responses when Vary values contain whitespace
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
High
CVE-2026-42860
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
Medium
CVE-2026-41654
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Critical
CVE-2026-42196
django-s3file is vulnerable to relative path traversal
Low
CVE-2026-6907
Django Uses Cache Containing Sensitive Information
Medium
CVE-2026-5766
Django has an Improper Handling of Length Parameter Inconsistency
Low
CVE-2026-35192
Django Uses Persistent Cookies Containing Sensitive Information
Low
CVE-2026-4292
Django vulnerable to privilege abuse in ModelAdmin.list_editable
Low
CVE-2026-4277
Django vulnerable to privilege abuse in GenericInlineModelAdmin
High
CVE-2026-3902
Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
High
CVE-2026-33034
Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
Medium
CVE-2026-33033
Django has potential DoS via MultiPartParser through crafted multipart uploads
Low
CVE-2026-34203
Nautobot: Management of users via REST API does not apply configured password validators
Medium
CVE-2026-34231
Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-30244
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure
Medium
CVE-2026-28222
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.