Low
CVE-2026-48589
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Low
CVE-2026-9497
TCC-TRANSACTION has an Improper Input Validation vulnerability
Medium
CVE-2026-44598
Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery
Medium
CVE-2026-43827
Apache Shiro has a session fixation vulnerability
Medium
CVE-2026-43828
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
Medium
CVE-2026-42797
Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries
High
CVE-2026-42782
Apache Syncope has an Improper Isolation or Compartmentalization vulnerability
High
CVE-2026-45361
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attack
Medium
CVE-2026-45249
Apache ECharts has a cross-site scripting (XSS) vulnerability
Medium
CVE-2026-41863
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk
Low
CVE-2026-9370
jasypt-spring-boot Uses a One-Way Hash without a Salt
Low
CVE-2026-9358
postcss-selector-parser allows denial of service through uncontrolled AST recursion
Critical
CVE-2018-25357
Dolibarr ERP CRM contains a remote code evaluation vulnerability
Low
CVE-2026-8347
Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog
Low
CVE-2026-8340
Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion
Low
CVE-2026-8353
Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme
Critical
CVE-2026-44930
Apache CXF has an LDAP injection vulnerability
Medium
CVE-2026-44618
Apache CXF's WS-Transfer module has an insecure XML parser configuration
High
CVE-2026-44417
Apache CXF: Untrusted JMS configuration can lead to RCE
Medium
CVE-2026-7493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service
Medium
CVE-2026-6565
Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title
Medium
CVE-2026-42735
KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization
Medium
CVE-2026-42776
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.6.7 - Missing Authorization
High
CVE-2025-69108
Hot Coffee <= 1.7 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.