Critical
CVE-2026-44790
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,540
Critical
CVE-2026-44789
n8n: HTTP Request Node Pagination Prototype Pollution to RCE
Medium
CVE-2026-42853
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
High
CVE-2026-46443
FlowiseAI Vulnerable to Credential Data Leak
Critical
CVE-2026-46442
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
High
CVE-2026-46441
FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment
High
CVE-2026-56274
Flowise has an MCP Security Bypass that Enables RCE
High
CVE-2026-46440
FlowiseAI Exposes Basic Auth Credentials via API
High
CVE-2026-42863
FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
High
CVE-2026-42862
FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
High
CVE-2026-42861
FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment
High
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
Critical
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
Medium
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API
Critical
CVE-2026-8178
Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading
Medium
CVE-2026-45205
Apache Commons Configuration: StackOverflowError for YAML input with cycles
High
CVE-2026-42672
WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection
Medium
CVE-2026-6415
Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field
High
CVE-2026-4094
FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion
Medium
CVE-2026-4683
Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update
Medium
CVE-2026-42673
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Exposure
Medium
CVE-2026-8151
Simple Membership MailChimp Integration <= 1.9.7 - Cross-Site Request Forgery
Medium
CVE-2026-42674
Advanced Access Manager – Access Governance for WordPress <= 7.1.0 - Missing Authorization
Medium
CVE-2026-6646
The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.