Critical
CVE-2026-36767
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-36340
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
High
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
High
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
High
CVE-2026-40171
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Medium
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Medium
CVE-2026-7500
Keycloak has a Forced Browsing issue
Medium
CVE-2026-41016
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Medium
CVE-2026-7446
mcp-server-semgrep has a Command Injection issue
Medium
CVE-2026-3143
Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation
High
CVE-2026-42774
JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection
Medium
CVE-2026-3140
Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
High
CVE-2026-3772
WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
Medium
CVE-2026-6127
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Medium
CVE-2026-41686
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
High
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Medium
CVE-2026-41671
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
High
CVE-2026-41670
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
High
CVE-2026-41669
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
Low
CVE-2026-41663
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
Medium
CVE-2026-41662
Admidio Missing Minimum Administrator Check in Role Membership Removal
Medium
CVE-2026-41661
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
High
CVE-2026-41660
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.