Critical
CVE-2026-3060
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Low
CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Low
CVE-2026-32108
Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
High
CVE-2026-31958
Tornado is vulnerable to DoS due to too many multipart parts
Critical
CVE-2026-31900
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
High
CVE-2026-26118
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Medium
CVE-2026-30974
copyparty: volflag `nohtml` did not block javascript in svg files
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
High
CVE-2026-0846
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files s
Medium
CVE-2025-70050
An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.
Medium
CVE-2026-29780
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
High
CVE-2026-29778
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
High
ghsa-qr2g-p6q7-w82m
x402 SDK Security Advisory
High
CVE-2026-29065
changedetection.io has Zip Slip vulnerability in the backup restore functionality
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-29039
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
High
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
High
CVE-2026-28438
CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
High
CVE-2026-28681
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
High
ghsa-5r2p-pjr8-7fh7
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
High
CVE-2026-30244
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure
High
CVE-2026-30242
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.