Critical
CVE-2026-41679
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
Medium
CVE-2026-40306
DNN: Same HostGUID for all new installs
Medium
CVE-2026-40305
DNN: Force Friend Request Acceptance
Medium
CVE-2026-40299
next-intl has an open redirect vulnerability
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
High
ghsa-75hx-xj24-mqrw
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
Low
CVE-2026-40194
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
High
CVE-2026-40321
DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
High
ghsa-6v7q-wjvx-w8wg
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Medium
CVE-2026-39921
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outboun
Medium
CVE-2026-39922
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
Medium
ghsa-vj8v-p5vw-m6v5
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
High
CVE-2026-40177
ajenti.plugin.core has password bypass when 2FA is activated
Medium
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Low
ghsa-xq4j-g85q-wf97
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Low
ghsa-m662-8jrj-cw6v
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
Low
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
Critical
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Critical
CVE-2026-40288
PraisonAI has critical RCE via `type: job` workflow YAML
High
CVE-2026-40287
PraisonAI Vulnerable to RCE via Automatic tools.py Import
Low
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
High
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.