Medium
CVE-2026-31865
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-29057
Next.js: HTTP request smuggling in rewrites
Medium
CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust storage
Medium
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
High
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
Medium
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Low
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Medium
CVE-2026-1780
[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-1926
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Medium
CVE-2026-4268
WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
Medium
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
High
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
High
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Medium
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
Low
CVE-2026-4202
Broken Access Control in extension "Redirect Tab" (redirect_tab)
High
CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
High
CVE-2026-4258
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
Medium
CVE-2026-25009
Education Zone <= 1.3.8 - Missing Authorization
High
CVE-2026-25457
Mixtape <= 2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25456
Automated FedEx live/manual rates with shipping labels – HPOS supported <= 5.1.8 - Missing Authorization
Medium
CVE-2026-40742
Nelio AB Testing <= 8.2.8 - Unauthenticated Information Exposure
High
CVE-2026-2992
KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
High
CVE-2026-25449
Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection
High
CVE-2026-24378
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.