Medium
CVE-2026-32948
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Unrated
pysec-2026-2
Two litellm versions published containing credential harvesting malware
Medium
CVE-2026-30662
ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads
High
CVE-2026-33310
Intake has a Command Injection via shell() Expansion in Parameter Defaults
High
CVE-2026-33497
langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
High
CVE-2026-33484
langflow has Unauthenticated IDOR on Image Downloads
Critical
CVE-2026-33309
Langflow has an Arbitrary File Write (RCE) via v2 API
Low
CVE-2026-32642
Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol
Medium
CVE-2026-3260
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
High
CVE-2026-22739
Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
Medium
CVE-2026-33290
WPGraphQL <= 2.9.1 - Missing Authorization
High
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Medium
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
Medium
CVE-2026-33486
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
High
CVE-2026-32300
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
High
CVE-2026-32299
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
Medium
CVE-2026-32279
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
High
CVE-2026-32278
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
High
CVE-2026-32277
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
High
CVE-2026-32276
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
Critical
CVE-2026-30849
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
Medium
CVE-2026-27131
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
High
CVE-2026-26209
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.