High
CVE-2026-31889
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-31888
Shopware has user enumeration via distinct error codes on Store API login endpoint
High
CVE-2026-31887
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Medium
CVE-2026-3429
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
Unrated
CVE-2026-4933
drupal/unpublished_node_permissions - SA-CONTRIB-2026-029
Unrated
CVE-2026-3573
drupal/ai - SA-CONTRIB-2026-028
Low
CVE-2026-56381
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
High
CVE-2026-31857
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
High
CVE-2026-31839
Striae has a hash validation utility vulnerability
High
CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
Medium
CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
High
CVE-2026-3657
My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action
Medium
CVE-2026-3226
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
Low
CVE-2026-3911
Keycloak: Information disclosure of disabled user attributes via administrative endpoint
High
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
Medium
CVE-2026-31901
Parse Server vulnerable to user enumeration via email verification endpoint
High
CVE-2026-31875
Parse Server's MFA recovery codes not consumed after use
High
CVE-2026-31872
Parse Server has a protected fields bypass via dot-notation in query and sort
Critical
CVE-2026-31871
Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
Medium
CVE-2026-31868
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types
Medium
CVE-2026-56763
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
High
CVE-2026-31858
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
Critical
CVE-2026-31856
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
Medium
CVE-2026-31859
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.