Critical
CVE-2026-7411
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-7412
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
Medium
CVE-2026-7457
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
Critical
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
High
ghsa-g485-8j3v-p6x8
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
Medium
CVE-2026-41417
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
Critical
CVE-2026-42864
FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
High
CVE-2026-42047
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
Medium
CVE-2026-42045
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
Critical
CVE-2026-25660
Codechecker has an authentication bypass for certain API calls
Medium
CVE-2026-6344
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
Medium
CVE-2026-6672
Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
High
CVE-2026-107376
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
Critical
CVE-2026-26956
VM2 Has a WASM Sandbox Escape
Critical
CVE-2026-26332
VM2 Has a Sandbox Escape Issue via SuppressedError
Critical
CVE-2026-24781
VM2 Has Sandbox Breakout Through Inspect Function
Critical
CVE-2026-24120
VM2 Has Sandbox Breakout Through Promise Species
Low
CVE-2026-6907
Django Uses Cache Containing Sensitive Information
Medium
CVE-2026-5766
Django has an Improper Handling of Length Parameter Inconsistency
Low
CVE-2026-35192
Django Uses Persistent Cookies Containing Sensitive Information
Medium
CVE-2025-61669
Jupyter Server has an open redirection vulnerability in `next` query parameter
Medium
CVE-2026-2306
Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
Medium
CVE-2026-3208
Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.