High
ghsa-j9gf-vw2f-9hrw
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
High
CVE-2026-48151
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Critical
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
High
ghsa-9wcp-79g5-5c3c
Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
Medium
CVE-2026-48147
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
Medium
CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
High
CVE-2025-52465
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Critical
CVE-2026-44172
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sen
Medium
CVE-2026-9134
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter
High
CVE-2026-9109
GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
High
CVE-2026-48146
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Medium
CVE-2026-48128
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
Medium
CVE-2026-48121
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
Medium
ghsa-6jq6-x4cx-qvcm
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
High
CVE-2026-9848
WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter
Medium
CVE-2026-12089
WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read
Critical
CVE-2026-50632
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
High
CVE-2026-50645
Apache cxf-core: No restriction on attachment headers per message
Medium
CVE-2026-50634
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Critical
CVE-2026-50633
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Critical
CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference
Medium
CVE-2026-50623
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.