High
CVE-2026-27191
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-27198
Formwork Improperly Managed Privileges in User creation
High
CVE-2026-27196
Statamic affected by privilege escalation via stored cross-site scripting
Medium
CVE-2026-82261
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
Medium
CVE-2026-82260
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
Low
ghsa-33hq-fvwr-56pm
devalue affected by CPU and memory amplification from sparse arrays
Low
ghsa-8qm3-746x-r74r
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
Medium
CVE-2026-27125
Svelte SSR attribute spreading includes inherited properties from prototype chain
Critical
CVE-2026-27212
Prototype pollution in swiper
High
CVE-2026-27203
eBay API MCP Server Affected by Environment Variable Injection
Low
CVE-2026-56764
Hono added timing comparison hardening in basicAuth and bearerAuth
High
CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
Medium
CVE-2026-28394
OpenClaw has a Web Fetch DoS via unbounded response parsing
High
CVE-2026-25940
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
High
CVE-2026-25755
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
Critical
CVE-2025-13590
carbon-apimgt does not properly restrict uploaded files
Low
CVE-2026-2733
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
Critical
CVE-2026-26030
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Medium
CVE-2026-25739
Indico Affected by Cross-Site-Scripting via material uploads
Medium
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple places
High
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
Medium
CVE-2026-27122
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Medium
CVE-2026-27121
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Medium
CVE-2026-27119
Svelte affected by XSS in SSR `<option>` element
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.