Critical
CVE-2026-55471
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-55470
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
High
CVE-2026-55760
handlebars.java FileTemplateLoader Path Traversal
High
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
Unrated
CVE-2026-55810
drupal/plotly_js - SA-CONTRIB-2026-050
High
CVE-2026-55405
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
Unrated
CVE-2026-55809
drupal/flag_attendance_field - SA-CONTRIB-2026-049
Unrated
CVE-2026-12535
drupal/formatter_field - SA-CONTRIB-2026-048
High
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Medium
CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Medium
CVE-2026-41280
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
Medium
CVE-2026-42357
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Critical
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
Critical
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
High
CVE-2026-11395
CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
Medium
CVE-2026-12111
Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
Medium
CVE-2026-9595
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
High
CVE-2026-5079
Multer vulnerable to Denial of Service via deeply nested field names
Medium
CVE-2026-12098
PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
Medium
CVE-2026-5038
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Low
CVE-2026-12102
UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
Medium
CVE-2026-54316
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
High
CVE-2026-53840
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Medium
CVE-2026-12136
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.