Medium
CVE-2026-28415
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Medium
CVE-2026-28208
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
Medium
CVE-2026-32898
OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata
Medium
CVE-2026-4039
OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)
High
CVE-2026-27939
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Medium
CVE-2026-28352
Indico has a missing access check in the event series management API
High
CVE-2026-27836
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
Medium
CVE-2026-28231
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
Medium
CVE-2026-27638
@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
High
CVE-2025-13673
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
High
CVE-2026-27449
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
High
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
High
CVE-2026-26862
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage
High
CVE-2026-26861
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function
High
CVE-2026-2471
WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
Medium
ghsa-747p-wmpv-9c78
AWS CLI: cli_history database does not restrict file permissions on Unix systems
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
Low
CVE-2025-12150
Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass
Medium
CVE-2026-0871
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
Low
CVE-2026-3293
Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner
Critical
CVE-2026-28370
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
Critical
CVE-2026-28363
OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.