Low
CVE-2026-41659
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Medium
CVE-2026-41657
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php
Medium
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Medium
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Medium
CVE-2026-44996
OpenClaw: Webchat audio embedding could read local files without local-root containment
Medium
CVE-2026-44991
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners
Critical
CVE-2026-42232
n8n has XML Node Prototype Pollution that to RCE
Critical
CVE-2026-42231
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
High
CVE-2026-42235
n8n Vulnerable to XSS via MCP OAuth client
High
CVE-2026-42226
n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
High
CVE-2026-42234
n8n has a Python Task Runner Sandbox Escape Vulnerability
Medium
CVE-2026-42227
n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure
High
CVE-2026-42236
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
Medium
CVE-2026-42228
n8n Vulnerable to Hijacking of Unauthenticated Chat Execution
Medium
CVE-2026-42229
n8n has SQL Injection in SeaTable Node
Medium
CVE-2026-42230
n8n has Open Redirect in MCP OAuth Consent Flow
Medium
CVE-2026-42233
n8n has SQL Injection in Oracle Database Node via Limit Field
Medium
CVE-2026-42237
n8n has SQL Injection in Snowflake and MySQL Nodes
High
CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search requests
High
ghsa-h8cj-hpmg-636v
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
Medium
CVE-2026-42206
OpenID Connect nonce generated but never validated — ID token replay attack
High
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Critical
CVE-2026-41586
fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.