Medium
CVE-2026-4068
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-4006
Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter
High
CVE-2026-33151
socket.io allows an unbounded number of binary attachments
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
High
CVE-2026-32610
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Medium
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
High
CVE-2026-33131
h3 has a middleware bypass with one gadget
Medium
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
High
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Medium
CVE-2026-1323
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class
Medium
CVE-2026-82868
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
Medium
CVE-2026-82867
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
Unrated
CVE-2026-4393
drupal/autologout - SA-CONTRIB-2026-030
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
High
CVE-2026-32609
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
Medium
CVE-2026-33060
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
High
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Medium
CVE-2026-33051
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
High
CVE-2026-22730
SQL Injection in Spring AI MariaDBFilterExpressionConverter
High
CVE-2026-22729
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
High
CVE-2026-32608
Glances has a Command Injection via Process Names in Action Command Templates
Medium
CVE-2026-2575
Keycloak: Denial of Service due to excessive SAMLRequest decompression
High
CVE-2026-32596
Glances exposes the REST API without authentication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.