Medium
CVE-2026-41240
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-41239
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
High
CVE-2026-6857
camel-infinispan Vulnerable to Deserialization of Untrusted Data
High
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
High
ghsa-2r2p-4cgf-hv7h
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
Medium
CVE-2026-3361
WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
High
CVE-2026-41166
OpenRemote has Improper Access Control via updateUserRealmRoles function
High
ghsa-9237-rg5p-rhfw
@saltcorn/data: Tenant user role is used for tenant creation role check
Critical
CVE-2026-3844
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
Medium
CVE-2026-2951
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML
Medium
CVE-2026-1923
Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id
High
CVE-2026-40542
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Medium
CVE-2026-22748
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
High
CVE-2026-22753
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers
High
CVE-2026-22754
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules
Low
CVE-2026-22746
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Medium
CVE-2026-22747
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
High
CVE-2026-39449
Contact Form to Any API <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40781
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.6 - Missing Authorization
High
CVE-2026-39443
EmallShop <= 2.4.21 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.