Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Group: languages Tag: cwe-915 Clear

ID	Title	Severity	Tags	Detected
CVE-2026-71504	Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API... Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API...	High	Cwe 862 Cwe 915 PHP	5 days ago
CVE-2026-78416	Vulnerability in CVE-2026-78416 (CVE-2026-78416) vulnerability in CVE-2026-78416 (CVE-2026-78416). Risk of unauthorized operations or information disclosure.		PHP Remote Code Execution Cwe 915	5 days ago
CVE-2026-53958	Authentication Bypass in CVE-2026-53958 (CVE-2026-53958) authentication bypass in CVE-2026-53958 (CVE-2026-53958). Confidential information can be exposed externally. Exploitable via `PATCH /api/users/`.	High	JavaScript Cwe 287 Cwe 915	1 week ago
CVE-2026-72778	Vulnerability in csrf (CVE-2026-72778) vulnerability in csrf (CVE-2026-72778). Successful exploitation can lead to full system takeover.	High	PHP Remote Code Execution Cross-Site Request Forgery Cwe 915	2 weeks ago
CVE-2026-59888	Vulnerability in com.fasterxml.jackson.core:jackson-databind (CVE-2026-59888) vulnerability in com.fasterxml.jackson.core:jackson-databind (CVE-2026-59888). Risk of unauthorized operations or information disclosure. Exploitable via ``PropertyNamingStrategy``. Mitigation: upgrade to `2.21.4` or later.	Medium	Java Cwe 915	1 month ago
CVE-2026-55810	Vulnerability in drupal/plotly_js (CVE-2026-55810) vulnerability in drupal/plotly_js (CVE-2026-55810). Confidential information can be exposed externally. Exploitable via ``plotly_js_graph``. Mitigation: upgrade to `3.0.2` or later.	High	JavaScript Drupal Cwe 915 Plotly +1	1 month ago
CVE-2026-50281	Vulnerability in craftcms/cms (CVE-2026-50281) vulnerability in craftcms/cms (CVE-2026-50281). Risk of unauthorized operations or information disclosure. Exploitable via ``newAttributes``. Mitigation: upgrade to `5.9.21` or later.		PHP Cwe 915	1 month ago
CVE-2026-48943	Vulnerability in c (CVE-2026-48943) vulnerability in c (CVE-2026-48943). Risk of unauthorized operations or information disclosure. Exploitable via ``plg_user_k2``.	Medium	C Cwe 915 Joomlaworks K2	2 months ago
CVE-2026-44495	Code Injection in axios (CVE-2026-44495) code injection in axios (CVE-2026-44495). Confidential information can be exposed externally. Exploitable via ``Object.prototype.transformResponse``. Mitigation: upgrade to `1.15.0` or later.	High	JavaScript Cwe 94 Cwe 1321 Cwe 915 +13	3 months ago
CVE-2026-44494	Vulnerability in axios (CVE-2026-44494) vulnerability in axios (CVE-2026-44494). Confidential information can be exposed externally. Exploitable via `Authorization header`. Mitigation: upgrade to `1.15.0` or later.	High	JavaScript Cwe 441 Cwe 1321 Axios +1	3 months ago
CVE-2026-46625	Vulnerability in js-cookie (CVE-2026-46625) vulnerability in js-cookie (CVE-2026-46625). Data can be tampered with by attackers. Exploitable via ``for...in``. Mitigation: upgrade to `3.0.7` or later.	High	JavaScript Cwe 1321 Cwe 915 Js Cookie +7	3 months ago
CVE-2026-31252	Code Injection in deserialization (CVE-2026-31252) code injection in deserialization (CVE-2026-31252). Risk of unauthorized operations or information disclosure.	Medium	Python Insecure Deserialization Cwe 94 Cwe 915	3 months ago
CVE-2026-31251	Vulnerability in deserialization (CVE-2026-31251) vulnerability in deserialization (CVE-2026-31251). Risk of unauthorized operations or information disclosure.	High	Python Insecure Deserialization Cwe 20 Cwe 94 +1	3 months ago
CVE-2025-69690	Unsafe Deserialization in deserialization (CVE-2025-69690) vulnerability in deserialization (CVE-2025-69690). Successful exploitation can lead to full system takeover.	Critical	PHP Cwe 502 Cwe 915 Remote Code Execution +13	3 months ago
CVE-2025-69691	Vulnerability in pfsense (CVE-2025-69691) vulnerability in pfsense (CVE-2025-69691). Successful exploitation can lead to full system takeover.	Critical	PHP Cwe 284 Cwe 915 Pfsense +6	3 months ago
CVE-2026-42264	Vulnerability in axios (CVE-2026-42264) vulnerability in axios (CVE-2026-42264). Confidential information can be exposed externally. Exploitable via ``hasOwnProperty``. Mitigation: upgrade to `1.15.2` or later.	High	JavaScript Cwe 1321 Axios Cwe 915	3 months ago
CVE-2026-41139	Vulnerability in mathjs (CVE-2026-41139) vulnerability in mathjs (CVE-2026-41139). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `15.2.0` or later.	High	JavaScript Cwe 915 Mathjs Cwe 94	3 months ago
CVE-2026-42041	Authentication Bypass in axios (CVE-2026-42041) authentication bypass in axios (CVE-2026-42041). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.15.1` or later.	Medium	JavaScript Cwe 287 Cwe 1321 Cwe 915 +1	4 months ago
CVE-2026-42044	Vulnerability in privilege-escalation (CVE-2026-42044) vulnerability in privilege-escalation (CVE-2026-42044). Data can be tampered with by attackers. Mitigation: upgrade to `1.15.2` or later.	Medium	JavaScript Privilege Escalation Cwe 915 Cwe 1321 +1	4 months ago
CVE-2026-42033	Vulnerability in axios (CVE-2026-42033) vulnerability in axios (CVE-2026-42033). Confidential information can be exposed externally. Mitigation: upgrade to `1.15.1` or later.	High	JavaScript Cwe 1321 Cwe 915 Axios	4 months ago
CVE-2026-40897	Vulnerability in mathjs (CVE-2026-40897) vulnerability in mathjs (CVE-2026-40897). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `15.2.0` or later.	High	JavaScript Cwe 915 Cwe 917 Mathjs	4 months ago
CVE-2026-40175	Vulnerability in axios (CVE-2026-40175) vulnerability in axios (CVE-2026-40175). Risk of unauthorized operations or information disclosure. Exploitable via `GET /pings`. Mitigation: upgrade to `0.31.0` or later.	Medium	JavaScript Remote Code Execution Cwe 113 Cwe 444 +3	4 months ago
CVE-2026-34406	Vulnerability in django (CVE-2026-34406) vulnerability in django (CVE-2026-34406). Successful exploitation can lead to full system takeover. Exploitable via `POST /api/auth/edituser/`.	High	Python Django Cwe 915 Aptrs	4 months ago
CVE-2026-33228	Vulnerability in webreflection (CVE-2026-33228) vulnerability in webreflection (CVE-2026-33228). Successful exploitation can lead to full system takeover.	Critical	JavaScript Cwe 1321 Cwe 915 Webreflection +1	5 months ago
CVE-2026-32640	Code Injection in simpleeval (CVE-2026-32640) code injection in simpleeval (CVE-2026-32640). Successful exploitation can lead to full system takeover. Exploitable via ``names``. Mitigation: upgrade to `1.0.5` or later.	Critical	Python Cwe 94 Cwe 915 Danthedeckie +1	5 months ago
CVE-2026-29063	Vulnerability in immutable-js (CVE-2026-29063) vulnerability in immutable-js (CVE-2026-29063). Successful exploitation can lead to full system takeover.	Critical	JavaScript Cwe 1321 Cwe 915 Immutable Js +1	5 months ago
CVE-2026-25521	Vulnerability in locutus (CVE-2026-25521) vulnerability in locutus (CVE-2026-25521). Successful exploitation can lead to full system takeover.	High	JavaScript Cwe 1321 Cwe 915 Locutus	6 months ago

Vulnerabilities

🍪 About cookies