Medium
CVE-2026-40181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-33245
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
Medium
CVE-2026-33244
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
Medium
CVE-2022-31114
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
High
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
Unrated
CVE-2026-10770
drupal/cleantalk - SA-CONTRIB-2026-042
Unrated
CVE-2026-10769
drupal/commerce - SA-CONTRIB-2026-041
Unrated
CVE-2026-10768
drupal/localgov_workflows - SA-CONTRIB-2026-039
Medium
CVE-2026-44546
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \
Low
CVE-2026-35193
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
High
CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote at
Low
CVE-2026-8404
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Low
CVE-2026-7666
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Low
CVE-2026-6873
Django: signed cookies are vulnerable to salt namespace collisions
High
CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
Low
CVE-2026-48587
Django: has_vary_header may expose cached responses when Vary values contain whitespace
High
CVE-2026-10737
SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
Critical
CVE-2026-47065
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass
Medium
CVE-2026-8653
MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
Low
CVE-2026-10691
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
Low
CVE-2026-10690
DesktopCommanderMCP is vulnerable to SSRF
Medium
CVE-2026-49057
JobSearch WP Job Board <= 3.2.7 - Missing Authorization
Medium
CVE-2026-48969
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.