Critical
CVE-2026-40933
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-41245
Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix
High
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Medium
CVE-2026-41244
Mojic: Observable Timing Discrepancy in HMAC Verification
Medium
CVE-2026-41213
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
Critical
CVE-2026-40324
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
Medium
CVE-2026-40186
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
High
CVE-2026-39313
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
High
CVE-2026-35569
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Medium
CVE-2026-34164
Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Medium
CVE-2026-33888
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
Low
CVE-2026-33877
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Medium
CVE-2026-24749
Silverstripe Assets Module has a DBFile::getURL() permission bypass
Medium
CVE-2026-6439
VideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field
Medium
CVE-2026-6451
CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery
Medium
CVE-2026-6441
Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification
High
CVE-2026-4659
Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
Medium
CVE-2026-5797
Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
High
CVE-2026-31987
Apache Airflow: JWT token appearing in logs
Critical
CVE-2026-31843
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files
High
CVE-2025-54550
Apache Airflow: RCE by race condition in example_xcom dag
High
CVE-2026-30778
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.