High
CVE-2026-41066
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-42241
ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
High
CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module
High
CVE-2026-40068
Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
High
CVE-2026-33524
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
High
CVE-2026-42239
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
Low
CVE-2026-41498
Kimai has Missing Object-Level Authorization in the Team API
Medium
CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
Medium
CVE-2026-42190
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
High
CVE-2026-41311
liquidjs has a Denial of Service via circular block reference in layout
Medium
CVE-2026-40690
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
Medium
CVE-2026-38743
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
Medium
CVE-2026-41305
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
High
CVE-2026-40466
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
High
CVE-2026-41044
Apache ActiveMQ Vulnerable to Code Injection
Medium
CVE-2026-41043
Apache ActiveMQ Vulnerable to Cross-site Scripting
Medium
CVE-2025-62233
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability
High
CVE-2026-23902
Apache DolphinScheduler has an Incorrect Authorization Vulnerability
Medium
CVE-2026-4512
reCaptcha by WebDesignBy < 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-4106
HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure
Medium
CVE-2026-40793
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization
Medium
CVE-2026-40794
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.3 - Missing Authorization
Low
CVE-2026-41321
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
High
CVE-2026-41900
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.