High
CVE-2026-40978
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-40980
Spring AI Vulnerable to OOM by attacker-controlled PDF
Medium
CVE-2026-40979
Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory
High
CVE-2026-40967
Spring AI has a VectorStore FilterExpression Converter injection
Medium
CVE-2026-7223
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue
High
CVE-2026-40973
Spring Boot accepts predictable temp directory without ownership verification
Critical
CVE-2026-40976
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
Medium
CVE-2026-40977
Spring Boot's PID file write follows symlinks at predictable default path
Medium
CVE-2026-40974
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Medium
CVE-2026-40975
Spring Boot's random value property source uses a weak PRNG unsuitable for secrets
Medium
CVE-2026-40971
Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker
High
CVE-2026-40972
Spring Boot DevTools remote secret comparison is vulnerable to timing attacks
Medium
CVE-2026-2902
WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment
High
CVE-2026-5306
Check & Log Email – Easy Email Testing & Mail logging < 2.0.13 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40795
Booking for Appointments and Events Calendar – Amelia <= 2.2 - Missing Authorization
Medium
CVE-2026-5362
Pimcore has an authenticated Cross-site Scripting issue
Medium
CVE-2026-40970
Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.
Medium
CVE-2026-4911
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
Medium
CVE-2026-4805
Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block
Low
CVE-2026-7141
vLLM makes Use of Uninitialized Resource
Medium
CVE-2026-6551
Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
Medium
CVE-2026-6809
Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed
Medium
CVE-2026-6725
WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
Medium
CVE-2026-41081
Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal Assignment
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.