High
CVE-2026-53441
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2025-71329
image-size: JXL and HEIF parsers allow denial of service through infinite loops
High
CVE-2025-71330
image-size: ICNS parser allows denial of service through an infinite loop
Low
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
Medium
CVE-2026-48037
@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
High
CVE-2026-48036
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
High
CVE-2026-48035
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
High
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
High
CVE-2026-48033
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
High
CVE-2026-48032
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Medium
CVE-2026-2827
Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'
High
CVE-2026-10721
Concrete CMS: PHP Object Injection via unserialize() calls
Medium
CVE-2026-47838
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Medium
CVE-2026-53675
BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR
High
CVE-2026-53673
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Medium
CVE-2026-41721
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Medium
CVE-2026-41719
Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries
Medium
CVE-2026-41730
Spring Data REST potentially exposes persistence-layer internals to HTTP clients
Medium
CVE-2026-41727
Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation
High
CVE-2026-41732
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
High
CVE-2026-41728
Spring Data REST has Improper Access Control in its JSON Patch Implementation
High
CVE-2026-41729
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Medium
CVE-2026-41837
Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations
Medium
CVE-2026-41726
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.