High
CVE-2026-73406
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,436
Critical
CVE-2026-73407
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Critical
CVE-2026-73302
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
High
CVE-2026-72855
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
High
CVE-2026-72859
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
High
CVE-2026-73409
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Critical
CVE-2026-73300
Budibase: SQL Injection via `multipleStatements: true`
High
CVE-2026-73303
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Medium
CVE-2026-73304
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Medium
CVE-2026-73301
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
High
CVE-2026-73305
Budibase: Privilege escalation via public role assignment API missing app-level authorization
High
CVE-2026-44907
react-server-dom: Denial of Service in Server Functions
Critical
CVE-2026-62379
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
Medium
CVE-2026-62280
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Critical
CVE-2026-62263
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Medium
CVE-2026-15425
Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
High
CVE-2026-10818
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
Medium
CVE-2026-14955
Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
High
CVE-2026-55607
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
High
CVE-2026-73507
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Medium
CVE-2026-73508
Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
High
CVE-2026-73643
js-yaml: Exponential parsing time in flow collections leads to denial of service
High
ghsa-qwww-vcr4-c8h2
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
Low
ghsa-464c-974j-9xm6
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.