Critical
CVE-2026-28292
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Low
CVE-2026-2741
Vaadin: Specially crafted ZIP archives can escape the intended extraction directory
Medium
CVE-2026-2742
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
High
CVE-2026-26118
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Medium
CVE-2026-23907
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
High
CVE-2025-56421
LimeSurvey is vulnerable to SQL injection
Critical
CVE-2026-31840
Parse Server: SQL injection via dot-notation field name in PostgreSQL
Medium
CVE-2026-31867
Craft Commerce: Potential IDOR in Commerce carts
Low
CVE-2026-29177
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Medium
CVE-2026-29176
Craft Commerce has stored XSS in Inventory Location Name
High
CVE-2026-29175
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Low
CVE-2026-29173
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Low
CVE-2026-29113
Craft CMS has a potential information disclosure vulnerability in preview tokens
Medium
CVE-2026-30974
copyparty: volflag `nohtml` did not block javascript in svg files
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
High
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
High
CVE-2026-3496
JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter
Medium
CVE-2026-3534
Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
High
CVE-2026-3222
WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter
Medium
CVE-2026-2707
weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
Medium
CVE-2026-2358
WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.