Medium
CVE-2026-30139
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Unrated
CVE-2026-6871
drupal/obfuscate - SA-CONTRIB-2026-033
High
CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Medium
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Medium
CVE-2026-41691
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
High
CVE-2026-41690
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
Medium
CVE-2026-41240
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Medium
CVE-2026-41239
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
High
CVE-2026-6857
camel-infinispan Vulnerable to Deserialization of Untrusted Data
High
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
High
ghsa-2r2p-4cgf-hv7h
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
Medium
CVE-2026-3361
WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
High
CVE-2026-41166
OpenRemote has Improper Access Control via updateUserRealmRoles function
High
ghsa-9237-rg5p-rhfw
@saltcorn/data: Tenant user role is used for tenant creation role check
Critical
CVE-2026-3844
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
Medium
CVE-2026-2951
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML
Medium
CVE-2026-1923
Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id
High
CVE-2026-40542
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Medium
CVE-2026-22748
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
High
CVE-2026-22753
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.