Medium
CVE-2026-32878
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Low
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
High
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
Medium
CVE-2026-32636
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
Critical
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
High
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color
High
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
High
CVE-2026-33013
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Medium
CVE-2026-31865
Elysia Cookie Value Prototype Pollution
Medium
CVE-2026-29057
Next.js: HTTP request smuggling in rewrites
Medium
CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust storage
Medium
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
High
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
Medium
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Low
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Medium
CVE-2026-1780
[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-1926
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Medium
CVE-2026-4268
WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
Medium
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
High
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
High
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Medium
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
Low
CVE-2026-4202
Broken Access Control in extension "Redirect Tab" (redirect_tab)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.