High
CVE-2026-50888
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2026-50886
Project Firefly III has incorrect access control in the webhook management component
Critical
CVE-2026-50887
shlink has a Server-Side Request Forgery issue
High
CVE-2026-47835
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
High
CVE-2026-41708
Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability
Critical
CVE-2026-39006
SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component
Critical
CVE-2026-30121
Remotion: arbitrary file write vulnerability
Critical
CVE-2026-30120
Remotion: remote code execution (RCE) vulnerability
Medium
CVE-2026-2381
WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
High
CVE-2026-8176
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
Low
ghsa-rq7w-g337-39qq
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
High
CVE-2026-11417
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
Medium
CVE-2026-50560
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Medium
CVE-2026-50020
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
High
CVE-2026-50011
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
High
CVE-2026-50010
Netty: Wrapping plain trust manager silently disables hostname verification
High
CVE-2026-8442
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
Medium
CVE-2026-50009
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
High
CVE-2026-48748
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
Medium
CVE-2026-48988
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Medium
CVE-2026-54285
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
Medium
CVE-2026-91992
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
High
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash
Critical
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.