Mittel
CVE-2026-32878
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.602
Hoch
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Niedrig
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
Hoch
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
Mittel
CVE-2026-32636
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
Kritisch
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
Hoch
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color
Hoch
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Hoch
CVE-2026-33013
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Mittel
CVE-2026-31865
Elysia Cookie Value Prototype Pollution
Mittel
CVE-2026-29057
Next.js: HTTP request smuggling in rewrites
Mittel
CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust storage
Mittel
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
Hoch
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
Mittel
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Niedrig
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Mittel
CVE-2026-1780
[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
Mittel
CVE-2026-1926
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Mittel
CVE-2026-4268
WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
Mittel
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
Hoch
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
Hoch
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Mittel
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
Niedrig
CVE-2026-4202
Broken Access Control in extension "Redirect Tab" (redirect_tab)
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.