Medium
CVE-2026-6498
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
High
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Critical
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Medium
CVE-2026-41484
OneCollector exporter reads unbounded HTTP response bodies
High
CVE-2026-38991
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-38993
Cockpit is vulnerable to directory traversal
Medium
CVE-2026-41483
OpenTelemetry.Resources.Azure has an unbounded HTTP response body read
Medium
CVE-2026-42525
Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability
High
CVE-2026-42524
Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
Critical
CVE-2026-38992
Cockpit is vulnerable to arbitrary code execution
Medium
CVE-2026-42519
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Medium
CVE-2026-42521
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Critical
CVE-2026-42523
Jenkins GitHub Plugin has an XSS vulnerability
Medium
CVE-2026-42522
Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test
High
CVE-2026-42520
Jenkins Credentials Binding Plugin has a path traversal vulnerability
Low
CVE-2026-22741
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Medium
CVE-2026-22745
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources
Medium
CVE-2026-22740
Spring Framework DoS with Multipart Temp Files in WebFlux
High
CVE-2026-42615
CyberChef has a Cross-site Scripting issue
Low
CVE-2026-7303
xxl-job has a Resource Injection issue
High
CVE-2026-42658
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40796
WPPizza – A Restaurant Plugin <= 3.19.9 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-42655
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.19 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.