High
ghsa-89v5-38xr-9m4j
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
ghsa-vj2p-7pgw-g2wf
Postiz App has a High-Severity SSRF Vulnerability via Next.js
Medium
CVE-2026-33541
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service
High
CVE-2026-29788
TSPortal: Any user can forge self-deletion requests for any account
Unrated
pysec-2026-3
Two telnyx versions published containing credential harvesting malware
High
CVE-2025-12886
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path
High
CVE-2026-4987
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
High
CVE-2026-4248
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
High
CVE-2026-22744
Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters
High
CVE-2026-22742
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
High
CVE-2026-22743
Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter
Critical
CVE-2026-22738
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
High
CVE-2026-33744
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
High
CVE-2026-33718
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
High
CVE-2026-27893
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
Medium
CVE-2026-32514
Petitioner <= 0.7.3 - Missing Authorization
Medium
CVE-2026-42648
Spectra <= 2.19.22 - Missing Authorization
Medium
CVE-2026-39477
CartFlows <= 2.2.3 - Missing Authorization
Medium
CVE-2026-33559
OSM – OpenStreetMap < 6.1.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-39501
FOX <= 1.4.5 - Missing Authorization
High
CVE-2026-2343
PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure
High
CVE-2026-32505
Kiddy <= 2.0.8 - Unauthenticated Local File Inclusion
High
ghsa-wcjx-v2wj-xg87
C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.