High
CVE-2026-54087
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Low
CVE-2026-54335
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
Medium
CVE-2026-50157
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
Critical
CVE-2026-54052
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
High
CVE-2026-50131
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Low
CVE-2026-45710
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
High
CVE-2026-45263
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
High
CVE-2026-59886
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
High
CVE-2026-59197
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
High
CVE-2026-59884
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
High
CVE-2026-59885
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
High
CVE-2026-45693
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
Critical
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Medium
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
High
CVE-2026-59205
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
High
CVE-2026-59199
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Critical
CVE-2026-13001
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
Critical
CVE-2026-27690
SAP Approuter Vulnerable to HTTP Request Smuggling
High
CVE-2026-44745
SAP Approuter has an Open Redirect vulnerability
Medium
CVE-2026-52828
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
High
CVE-2026-52827
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP
Medium
CVE-2026-52826
Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
Medium
CVE-2026-52825
Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility
Critical
CVE-2026-52824
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.