High
CVE-2026-41284
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,540
Low
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time
Critical
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user
High
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Critical
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied
High
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure
Critical
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated
Critical
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Critical
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
High
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
High
CVE-2026-41895
changedetection.io project has an XXE vulnerability
Medium
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
High
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
Medium
CVE-2025-14033
ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Medium
CVE-2026-6962
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Medium
CVE-2025-9988
Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
Medium
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Medium
CVE-2025-9987
Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure
Medium
CVE-2025-9989
Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-7051
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
Medium
CVE-2025-14755
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
Critical
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.