Medium
CVE-2026-42237
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search requests
High
ghsa-h8cj-hpmg-636v
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
Medium
CVE-2026-42206
OpenID Connect nonce generated but never validated — ID token replay attack
High
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Critical
CVE-2026-41586
fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE
Medium
CVE-2026-6498
Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter
High
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
High
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Critical
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Medium
CVE-2026-41484
OneCollector exporter reads unbounded HTTP response bodies
High
CVE-2026-38991
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-38993
Cockpit is vulnerable to directory traversal
Medium
CVE-2026-41483
OpenTelemetry.Resources.Azure has an unbounded HTTP response body read
Medium
CVE-2026-42525
Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability
High
CVE-2026-42524
Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
Critical
CVE-2026-38992
Cockpit is vulnerable to arbitrary code execution
Medium
CVE-2026-42519
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Medium
CVE-2026-42521
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Critical
CVE-2026-42523
Jenkins GitHub Plugin has an XSS vulnerability
Medium
CVE-2026-42522
Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test
High
CVE-2026-42520
Jenkins Credentials Binding Plugin has a path traversal vulnerability
Low
CVE-2026-22741
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Medium
CVE-2026-22745
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.