Medium
CVE-2026-46634
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
Low
CVE-2026-46629
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
Low
CVE-2026-46628
Twig: The `spaceless` filter implicitly marks its output as safe
High
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
High
CVE-2026-82855
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
Critical
CVE-2026-82856
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
High
CVE-2026-82860
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
High
CVE-2026-82861
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
High
CVE-2026-82858
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans
Medium
CVE-2026-82863
@hulumi/baseline: CloudTrail selector tampering events were not fully detected
Medium
CVE-2026-46609
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
Low
CVE-2026-46554
NocoDB: Stale Auth Cache After API Token Deletion
Low
CVE-2026-46553
NocoDB: Attachment Size Limit Bypass via Upload-by-URL
Medium
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
Medium
CVE-2026-46551
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Medium
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
Low
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
Medium
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Medium
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
High
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
High
CVE-2026-46643
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
Medium
CVE-2026-46683
Snappy : SSRF and local file read via the xsl-style-sheet option
Medium
CVE-2026-46616
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.