High
CVE-2026-32609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
High
CVE-2026-32596
Glances exposes the REST API without authentication
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
High
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
High
CVE-2026-31899
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
High
CVE-2026-21887
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
Low
CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
Medium
CVE-2026-29780
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
High
CVE-2026-29065
changedetection.io has Zip Slip vulnerability in the backup restore functionality
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-29039
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
High
CVE-2026-28438
CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
High
CVE-2026-28681
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
High
ghsa-5r2p-pjr8-7fh7
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
High
CVE-2026-30244
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.