High
CVE-2026-34076
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
ghsa-27qh-8cxx-2cr5
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
High
CVE-2026-34046
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
High
CVE-2026-33989
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
High
CVE-2026-33942
Saloon has insecure deserialization in AccessTokenAuthenticator
High
CVE-2026-28369
Undertow is Vulnerable to HTTP Request/Response Smuggling
High
CVE-2026-28368
Undertow is Vulnerable to HTTP Request/Response Smuggling
High
CVE-2026-28367
Undertow is Vulnerable to HTTP Request/Response Smuggling
High
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
High
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
High
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
High
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Critical
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
Medium
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Medium
CVE-2026-1307
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
Medium
CVE-2026-56359
n8n has XSS in its Credential Management Flow
Medium
CVE-2026-56356
n8n has XSS in Chat Trigger Node through Custom CSS
Medium
CVE-2026-56354
n8n: Authenticated XSS and Open Redirect via Form Node
Medium
CVE-2026-56358
n8n has a Stored XSS Vulnerability in its Form Trigger
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Critical
CVE-2026-33992
pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
Medium
CVE-2026-33994
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
High
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.