Medium
CVE-2026-33171
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-33172
Statamic has Stored XSS via SVG Sanitization Bypass
High
CVE-2026-33166
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
High
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Medium
CVE-2026-3475
Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter
Medium
CVE-2026-30048
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability
High
CVE-2026-33001
Jenkins has a link following vulnerability allows arbitrary file creation
High
CVE-2026-33002
Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
Medium
CVE-2026-33004
Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
Medium
CVE-2026-33003
Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files
High
CVE-2026-32634
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Medium
CVE-2026-32632
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
High
CVE-2026-32611
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
Medium
CVE-2026-4068
Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
Medium
CVE-2026-4006
Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter
High
CVE-2026-33151
socket.io allows an unbounded number of binary attachments
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
High
CVE-2026-32610
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Medium
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
High
CVE-2026-33131
h3 has a middleware bypass with one gadget
Medium
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.