High
CVE-2026-27203
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Low
CVE-2026-56764
Hono added timing comparison hardening in basicAuth and bearerAuth
High
CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
Medium
CVE-2026-28394
OpenClaw has a Web Fetch DoS via unbounded response parsing
High
CVE-2026-25940
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
High
CVE-2026-25755
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
Critical
CVE-2025-13590
carbon-apimgt does not properly restrict uploaded files
Low
CVE-2026-2733
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
Critical
CVE-2026-26030
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Medium
CVE-2026-25739
Indico Affected by Cross-Site-Scripting via material uploads
Medium
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple places
High
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
Medium
CVE-2026-27122
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Medium
CVE-2026-27121
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Medium
CVE-2026-27119
Svelte affected by XSS in SSR `<option>` element
Medium
CVE-2026-27118
Cache poisoning in @sveltejs/adapter-vercel
Low
ghsa-9ppg-jx86-fqw7
Unauthorized npm publish of cline@2.3.0 with modified postinstall script
Medium
CVE-2026-25527
changedetection.io is vulnerable to unauthenticated static path traversal
Medium
CVE-2026-2384
Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-24126
Weblate has an argument injection in management console
High
CVE-2026-32393
Greenly Theme Addons < 8.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-39671
Extra Fees Plugin for WooCommerce <= 4.3.3 - Cross-Site Request Forgery
High
CVE-2026-39544
LabtechCO <= 8.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25385
URL Shortify <= 1.12.3 - Authenticated (Author+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.