High
CVE-2026-33128
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-1323
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class
Medium
CVE-2026-82868
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
Medium
CVE-2026-82867
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
Unrated
CVE-2026-4393
drupal/autologout - SA-CONTRIB-2026-030
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
High
CVE-2026-32609
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
Medium
CVE-2026-33060
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
High
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Medium
CVE-2026-33051
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
High
CVE-2026-22730
SQL Injection in Spring AI MariaDBFilterExpressionConverter
High
CVE-2026-22729
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
High
CVE-2026-32608
Glances has a Command Injection via Process Names in Action Command Templates
Medium
CVE-2026-2575
Keycloak: Denial of Service due to excessive SAMLRequest decompression
High
CVE-2026-32596
Glances exposes the REST API without authentication
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
High
CVE-2026-2603
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
High
CVE-2026-28500
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
High
CVE-2026-27459
pyOpenSSL DTLS cookie callback buffer overflow
Low
CVE-2026-27448
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
High
CVE-2026-1238
SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
High
CVE-2026-25447
Widget Wrangler <= 2.3.9 - Authenticated (Author+) Remote Code Execution
High
CVE-2026-25445
Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-2571
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.