High
CVE-2026-48036
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-48035
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
High
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
High
CVE-2026-48033
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
High
CVE-2026-48032
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Medium
CVE-2026-2827
Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'
High
CVE-2026-10721
Concrete CMS: PHP Object Injection via unserialize() calls
Medium
CVE-2026-47838
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Medium
CVE-2026-53675
BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR
High
CVE-2026-53673
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Medium
CVE-2026-41721
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Medium
CVE-2026-41719
Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries
Medium
CVE-2026-41730
Spring Data REST potentially exposes persistence-layer internals to HTTP clients
Medium
CVE-2026-41727
Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation
High
CVE-2026-41732
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
High
CVE-2026-41728
Spring Data REST has Improper Access Control in its JSON Patch Implementation
High
CVE-2026-41729
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Medium
CVE-2026-41837
Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations
Medium
CVE-2026-41726
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
High
CVE-2026-41731
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
Medium
CVE-2026-41711
Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)
Medium
CVE-2026-41706
Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache
High
CVE-2026-41716
Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys
High
CVE-2026-41003
Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.