Critical
CVE-2026-48062
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-48049
@hapi/inert has a static-file confinement bypass via sibling-prefix path
High
CVE-2026-11816
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filt
Medium
CVE-2026-48043
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Medium
CVE-2026-48040
netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access
High
CVE-2026-48068
@grpc/grpc-js: A malformed request can cause a server crash
High
CVE-2026-48069
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
Medium
CVE-2026-48038
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
High
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
Medium
CVE-2026-48022
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
High
CVE-2026-48007
Element Call reports full URLs of visited pages to analytics server
High
CVE-2026-48006
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
Medium
CVE-2026-53723
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
Medium
CVE-2026-48998
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Medium
CVE-2026-49214
guzzlehttp/psr7 has CRLF Injection via URI Host Component
Medium
CVE-2026-9125
The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
High
CVE-2026-5497
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
Medium
CVE-2026-41001
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration
High
CVE-2026-41856
Spring for GraphQL: Annotation Detection Vulnerability
High
CVE-2026-41699
Spring for GraphQL: Unsafe Deserialization
High
CVE-2026-41700
Spring for GraphQL: Cross-Site WebSocket Hijacking
High
CVE-2026-40999
Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations
High
CVE-2026-40994
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Medium
CVE-2026-40995
Spring Web Services: X.509 authentication bypasses Spring Security account checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.