High
CVE-2026-46373
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-46374
SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser
Critical
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Medium
CVE-2026-47767
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Critical
CVE-2025-6254
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation
High
CVE-2026-3018
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
Unrated
pysec-2026-207
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
Medium
CVE-2026-8613
aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
Medium
CVE-2026-8853
MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
Medium
CVE-2026-9019
Easy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters
High
CVE-2026-50636
LimeSurvey has a SQL Injection issue
High
CVE-2026-50635
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
Critical
CVE-2026-9277
shell-quote quote() does not escape newlines in object .op values
Medium
CVE-2026-49818
The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path o
High
CVE-2026-11572
degit has a Command Injection issue
Medium
CVE-2026-41853
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
Medium
CVE-2026-41851
Spring Framework Denial of Service via Unbounded Cache in SpEL
High
CVE-2026-41850
Spring Framework Algorithmic Denial of Service via SpEL Expressions
Low
CVE-2026-41852
Spring Framework Arbitrary Method Invocation in SpEL Expressions
Medium
CVE-2026-41846
Spring Framework Cross-site Scripting via JSP Form Tags
Low
CVE-2026-41848
Spring Framework Denial of Service via AntPathMatcher
High
CVE-2026-41855
Spring Framework Unsafe Deserialization via Jackson JMS Converters
Medium
CVE-2026-41854
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
Medium
CVE-2026-41847
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.