Critical
CVE-2026-41258
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-3359
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'
High
CVE-2026-42440
Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation
Critical
CVE-2026-42027
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
Critical
CVE-2026-42812
Apache Polaris has an Improper Input Validation issue
Critical
CVE-2026-42810
Apache Polaris has an Improper Input Validation Issue
Critical
CVE-2026-42811
Apache Polaris has an Improper Input Validation issue
Critical
CVE-2026-42809
Apache Polaris has an Improper Input Validation Issue
Critical
CVE-2026-40682
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
High
CVE-2026-40563
Apache Atlas has a Code Injection Vulnerability
High
CVE-2026-42088
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Pyt
Critical
CVE-2026-42087
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability ex
High
CVE-2026-42084
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality
Medium
CVE-2026-42085
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in
Medium
CVE-2026-42086
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
Medium
CVE-2026-3454
GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements
High
CVE-2026-5192
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
Critical
CVE-2026-40076
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
High
CVE-2026-4304
WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter
Medium
CVE-2026-2729
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
High
CVE-2026-39852
Quarkus has Authentication/Authorization bypasses
High
CVE-2026-40075
OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read
Low
CVE-2026-41358
OpenClaw: Slack thread context could include messages from non-allowlisted senders
Critical
CVE-2026-24118
VM2 Sandbox Breakout Through __lookupGetter__
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.