High
CVE-2026-44728
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,583
Medium
ghsa-qhh4-458h-xwh2
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
Critical
CVE-2026-44551
Open WebUI has an LDAP Empty Password Authentication Bypass
Medium
CVE-2026-44737
Grav: Stored XSS via page title (data[header][title]) in admin panel
High
CVE-2026-44680
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
High
CVE-2026-6322
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
Critical
CVE-2026-43944
Electerm users can run dangrous code through link or command line
High
CVE-2026-43943
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
Medium
CVE-2026-43942
Electerm's full process.env exposed to renderer via window.pre.env
High
CVE-2026-43941
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click
Critical
CVE-2026-43940
Electerm runWidget has a path traversal that leads to arbitrary code execution
High
CVE-2024-27355
phpseclib guardrails needed on OID length
Low
CVE-2026-4671
justhtml introduces denial-of-service hardening
High
CVE-2026-44714
bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass
Medium
ghsa-q9m2-fhv9-3jcf
`potato-annotation` has a Project-Boundary Bypass
High
CVE-2026-6321
fast-uri vulnerable to path traversal via percent-encoded dot segments
High
CVE-2026-7768
@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
High
ghsa-8g7g-hmwm-6rv2
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
High
CVE-2026-44694
n8n-mcp webhook and API client paths has an authenticated SSRF
Critical
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view
High
ghsa-52cq-7v8r-62c6
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
High
CVE-2026-44665
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
Medium
CVE-2026-44664
fast-xml-builder Comment Value regex can be bypassed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.