Critical
CVE-2026-29792
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-28692
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
High
CVE-2026-1993
ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
Medium
CVE-2026-28689
ImageMagick has a Path Policy TOCTOU symlink race bypass
High
CVE-2026-1992
ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
High
CVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Medium
CVE-2026-2917
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
Medium
CVE-2026-2918
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
Critical
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Low
CVE-2026-2741
Vaadin: Specially crafted ZIP archives can escape the intended extraction directory
Medium
CVE-2026-2742
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
High
CVE-2026-26118
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Medium
CVE-2026-23907
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
High
CVE-2025-56421
LimeSurvey is vulnerable to SQL injection
Critical
CVE-2026-31840
Parse Server: SQL injection via dot-notation field name in PostgreSQL
Medium
CVE-2026-31867
Craft Commerce: Potential IDOR in Commerce carts
Low
CVE-2026-29177
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Medium
CVE-2026-29176
Craft Commerce has stored XSS in Inventory Location Name
High
CVE-2026-29175
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Low
CVE-2026-29173
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Low
CVE-2026-29113
Craft CMS has a potential information disclosure vulnerability in preview tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.