Medium
CVE-2026-28231
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-27638
@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
High
CVE-2025-13673
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
High
CVE-2026-27449
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
High
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
High
CVE-2026-26862
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage
High
CVE-2026-26861
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function
High
CVE-2026-2471
WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
Medium
ghsa-747p-wmpv-9c78
AWS CLI: cli_history database does not restrict file permissions on Unix systems
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
Low
CVE-2025-12150
Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass
Medium
CVE-2026-0871
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
Low
CVE-2026-3293
Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner
Critical
CVE-2026-28370
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
Critical
CVE-2026-28363
OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode
Low
CVE-2026-3269
PSI Probe: Broken access control can lead to DoS
Low
CVE-2026-3270
PSI Probe vulnerable to Server-Side Request Forgery
High
CVE-2026-28062
Happy Baby <= 1.2.12 - Unauthenticated Local File Inclusion
High
CVE-2026-28052
Peter Mason <= 1.4.5 - Unauthenticated Local File Inclusion
High
CVE-2026-28050
Beacon <= 2.24 - Unauthenticated Local File Inclusion
High
CVE-2026-28058
Dixon <= 1.4.2.1 - Unauthenticated Local File Inclusion
High
CVE-2026-28055
M.Williamson <= 1.2.11 - Unauthenticated Local File Inclusion
High
CVE-2026-28049
Police Department <= 2.17 - Unauthenticated Local File Inclusion
High
CVE-2026-28067
Bassein <= 1.0.15 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.