High
CVE-2026-41699
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-41700
Spring for GraphQL: Cross-Site WebSocket Hijacking
High
CVE-2026-40999
Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations
High
CVE-2026-40994
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Medium
CVE-2026-40995
Spring Web Services: X.509 authentication bypasses Spring Security account checks
Low
CVE-2026-41000
Spring Web Services: WSS4J validation does not use configured replay cache
High
CVE-2026-40998
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Medium
CVE-2026-40996
Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Medium
CVE-2026-40997
Spring Web Services: SOAP security faults leak Spring Security account state
Medium
CVE-2026-40986
Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Medium
CVE-2026-40992
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
High
CVE-2026-40987
Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
Medium
CVE-2026-40985
Spring Web Flow has Data Binding Vulnerability with Unified EL Parser
High
CVE-2026-10142
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by
High
CVE-2026-10143
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by suppl
High
CVE-2026-6379
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection
Medium
CVE-2026-9067
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
Critical
CVE-2026-11976
MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor
High
CVE-2026-3326
XStore < 9.7.3 - Unauthenticated SQL Injection
High
CVE-2026-5776
Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-1631
Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 - Missing Authorization
Medium
CVE-2026-11781
Adminify <= 4.2.9 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-7385
Decent Comments < 3.0.2 - Unauthenticated Information Exopsure
Medium
CVE-2026-6268
EventPress < 22.2 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.