Critical
CVE-2026-54617
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
High
CVE-2026-49284
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
Low
CVE-2026-80197
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
High
CVE-2026-2092
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Low
CVE-2026-50268
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Medium
CVE-2026-50267
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
Medium
CVE-2026-50202
Steeltoe's static JWKS cache shared across schemes and never invalidated
Medium
CVE-2026-50201
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
High
CVE-2026-50200
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
High
CVE-2026-50196
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
High
CVE-2026-50194
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
High
CVE-2026-49289
SimpleSAMLphp has Possible DoS via XPath Transform
High
CVE-2026-49283
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
Medium
ghsa-x4hg-hfwf-p9mw
@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
High
ghsa-322x-v876-g883
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
Critical
CVE-2026-59800
9router: Missing Authorization and OS Command Injection
Medium
ghsa-gj2h-2fpw-fhv9
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
High
CVE-2026-52746
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
High
CVE-2026-50282
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
High
CVE-2026-50281
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Medium
CVE-2026-9811
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
High
CVE-2026-9809
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
High
CVE-2026-9808
Mautic has an Authorization Bypass in API v2 Endpoints
Critical
CVE-2026-9559
Mautic vulnerable to Path Traversal via Campaign Import
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.