High
CVE-2026-55690
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-55091
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
High
CVE-2026-55849
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
High
ghsa-v52w-28xh-v562
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
High
CVE-2026-54784
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
High
CVE-2026-54783
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
Critical
CVE-2026-54782
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
High
CVE-2026-54781
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
Low
CVE-2026-54780
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
Medium
CVE-2026-54779
CoreWCF: SAML token replay protection is inoperative
Medium
CVE-2026-54778
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Medium
CVE-2026-54777
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Medium
CVE-2026-54776
CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
Medium
CVE-2026-54775
CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
High
CVE-2026-54774
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
Medium
CVE-2026-54773
CoreWCF: WS-Security signature substitution via document-wide Signature lookup
High
CVE-2026-54772
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
Medium
CVE-2026-12119
Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
High
CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
High
CVE-2026-11912
Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
Low
CVE-2026-55778
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
High
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
Medium
CVE-2026-53726
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Medium
CVE-2026-53725
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.