High
CVE-2026-3368
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-3350
Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title
Critical
CVE-2026-3584
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
High
CVE-2026-33053
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
High
CVE-2026-32874
UltraJSON has a Memory Leak parsing large integers allows DoS
High
CVE-2026-32875
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
High
CVE-2026-32711
pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
Low
CVE-2026-22735
Spring MVC and WebFlux has Server Sent Event stream corruption
Critical
CVE-2026-22732
Spring Security HTTP Headers Are not Written Under Some Conditions
High
CVE-2026-22733
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
High
CVE-2026-22731
Spring Boot has an Authentication Bypass under Actuator Health groups paths
Medium
CVE-2026-22737
Spring Framework Improper Path Limitation with Script View Templates
High
CVE-2026-25359
Pendulum < 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-32522
WooCommerce Support Ticket System < 18.5 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-31921
Product Rearrange for WooCommerce <= 1.2.2 - Missing Authorization
Medium
CVE-2026-32545
Taboola Pixel <= 1.1.4 - Reflected Cross-Site Scripting
High
CVE-2026-32499
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection
High
CVE-2026-32531
Kunco < 1.4.5 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25304
Jaroti < 1.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-32542
Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-25351
MyMedi < 1.7.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-25365
Kargo Takip < 0.2.4 - Missing Authorization
Medium
CVE-2026-32498
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization
Medium
CVE-2026-32521
WP Custom Admin Interface <= 7.42 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.