Low
CVE-2026-3155
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-3489
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'
Medium
CVE-2026-40486
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
Medium
CVE-2026-40479
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
Critical
CVE-2026-40478
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Critical
CVE-2026-40477
Improper restriction of the scope of accessible objects in Thymeleaf expressions
Medium
CVE-2026-40346
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Medium
CVE-2026-86200
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
High
CVE-2026-40882
OpenRemote has XXE in Velbus Asset Import
Medium
CVE-2026-6367
Drupal core allows Cross-Site Scripting (XSS)
Medium
CVE-2026-6366
Drupal core allows Object Injection
Medium
CVE-2026-6365
Drupal core is Vulnerable to Cross-Site Scripting
Medium
CVE-2026-40942
Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
Medium
CVE-2026-40939
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Medium
CVE-2026-39845
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
High
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
High
CVE-2026-34242
Weblate: Arbitrary File Read via Symlink
Medium
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Medium
CVE-2026-33440
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
High
CVE-2026-33435
Weblate: Remote code execution during backup restoration
Medium
CVE-2026-33220
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Medium
CVE-2026-41161
Sync-in Server has Username Enumeration via Timing Attack
Medium
CVE-2026-0718
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.