High
CVE-2026-5463
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Low
CVE-2026-35537
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
Medium
CVE-2026-35540
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Medium
CVE-2026-35541
Roundcube Webmail: Incorrect password comparison in the password plugin
Medium
CVE-2026-35542
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
Low
CVE-2026-35538
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments
Medium
CVE-2026-35543
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
Medium
CVE-2026-35545
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
Medium
CVE-2026-35544
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Medium
CVE-2026-35539
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
High
CVE-2026-35536
Tornado has cookie attribute injection via .RequestHandler.set_cookie
Critical
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Critical
CVE-2026-34989
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
High
CVE-2026-35168
OpenSTAManager: SQL Injection via Aggiornamenti Module
Medium
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Medium
CVE-2026-65913
DOMPurify USE_PROFILES prototype pollution allows event handlers
High
ghsa-ghc5-95c2-vwcv
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
High
ghsa-vfpx-q664-h93m
Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption
High
ghsa-fmg6-246m-9g2v
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption
Critical
CVE-2026-67337
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)
Low
CVE-2026-41382
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps
Low
CVE-2026-41341
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message
Medium
CVE-2026-41300
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.