Programming languages and frameworks: vulnerabilities and fixes

Node.js, PHP, Python, Java, Spring, Django and the libraries built on them. 1179 CVEs tracked.

Programming languages and frameworks has 1179 tracked vulnerabilities, 176 critical and 5 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 695. Most recent: 2026-10-24. Highest priority: CVE-2016-3081 (score 93/100).

• CVE-2016-3081 HIGH 8.1 EXPLOITED MITIGATE DOWNGRADE Apache Struts Command Injection Vulnerability
• CVE-2026-110447 CRITICAL 9.2 EXPLOITED MITIGATE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
• CVE-2026-87902 HIGH 8.1 EXPLOITED UPGRADE WordPress Core Remote File Inclusion Vulnerability
• CVE-2026-82078 CRITICAL 9.1 EXPLOITED UPGRADE UPGRADE PaperCut NG/MF Unsafe Reflection Vulnerability
• CVE-2026-105133 HIGH 7.3 EXPLOITED UPGRADE Ahsay AhsayCBS Improper Authentication Vulnerability
• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2026-61498 CRITICAL 9.8 UPGRADE Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_gra
• CVE-2026-60121 CRITICAL 9.8 UPGRADE Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.ph
• CVE-2026-73034 CRITICAL 9.8 DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write a
• CVE-2026-65008 CRITICAL 9.8 Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system
• CVE-2026-44181 CRITICAL 10.0 UPGRADE Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Sp
• CVE-2026-59801 CRITICAL 9.8 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers t
• CVE-2026-66713 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Fou
• CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
• CVE-2026-16766 CRITICAL 9.8 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render
• CVE-2026-53595 CRITICAL 9.4 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework
• CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
• CVE-2026-73299 CRITICAL 10.0 Prompty is a markdown file format (.prompty) for LLM prompts
• CVE-2026-73487 CRITICAL 9.8 UPGRADE Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that
• CVE-2023-25207 CRITICAL 9.8 UPGRADE PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
• CVE-2026-47391 CRITICAL 9.8 PraisonAI is a multi-agent teams system
• CVE-2026-48030 CRITICAL 9.9 Pheditor is a single-file editor and file manager written in PHP
• CVE-2026-53975 CRITICAL 9.8 OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attacker
• CVE-2026-57517 CRITICAL 9.8 Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r
• CVE-2026-64193 CRITICAL 9.8 Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::R
• CVE-2026-64606 CRITICAL 9.8 UPGRADE Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during
• CVE-2026-69264 CRITICAL 9.8 UPGRADE Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly
• CVE-2023-2288 HIGH 8.8 UPGRADE The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing fi
• CVE-2026-53633 CRITICAL 9.8 Vitest is a testing framework powered by Vite
• CVE-2026-54733 CRITICAL 9.3 The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory inte
• CVE-2026-62183 CRITICAL 9.8 UPGRADE Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is
• CVE-2026-64827 CRITICAL 9.8 Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authenti
• CVE-2026-67919 CRITICAL 9.8 An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, instal
• CVE-2026-69098 CRITICAL 9.8 kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint th
• CVE-2026-70470 CRITICAL 9.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-70553 CRITICAL 9.8 MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arb
• CVE-2026-70554 CRITICAL 9.8 MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arb
• CVE-2026-72577 CRITICAL 9.8 Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve
• CVE-2026-72748 CRITICAL 9.1 AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpo
• CVE-2026-47393 CRITICAL 9.8 PraisonAI is a multi-agent teams system
• CVE-2026-55173 HIGH 8.1 WWBN AVideo is an open source video platform
• CVE-2026-68771 CRITICAL 9.8 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows u
• CVE-2026-70477 CRITICAL 9.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-36669 CRITICAL 9.8 An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allo
• CVE-2026-45336 CRITICAL 10.0 HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracki
• CVE-2026-50289 HIGH 8.8 UPGRADE systeminformation is a System and OS information library for node.js
• CVE-2026-67614 CRITICAL 9.8 CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service
• CVE-2023-22795 HIGH 7.5 UPGRADE MITIGATE A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-M
• CVE-2023-23919 HIGH 7.5 UPGRADE A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did d
• CVE-2026-16634 CRITICAL 9.8 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 l
• CVE-2026-48056 CRITICAL 10.0 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-49827 CRITICAL 9.8 WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry
• CVE-2026-54159 CRITICAL 10.0 PrestaShop ps_facetedsearch is a module that adds layered navigation filters
• CVE-2026-63304 HIGH 8.1 AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php wher
• CVE-2026-63305 HIGH 8.1 AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notif
• CVE-2026-69703 CRITICAL 9.8 Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/cont
• CVE-2026-70552 CRITICAL 9.8 MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allo
• CVE-2023-2017 HIGH 8.8 UPGRADE Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting bo
• CVE-2023-22974 HIGH 7.5 UPGRADE A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files b
• CVE-2026-16770 CRITICAL 9.8 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the sourc
• CVE-2026-17544 CRITICAL 9.8 UPGRADE Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PH
• CVE-2026-65883 CRITICAL 9.8 UPGRADE Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 2
• CVE-2026-67960 CRITICAL 9.8 An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserC
• CVE-2026-71207 CRITICAL 9.8 The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and buil
• CVE-2026-72592 CRITICAL 9.8 An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote att
• CVE-2026-76604 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
• CVE-2026-47698 CRITICAL 9.8 vm2 is an open source vm/sandbox for Node.js
• CVE-2026-58586 CRITICAL 9.8 Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link
• CVE-2026-59861 HIGH 7.5 Kiota is an OpenAPI based HTTP Client code generator
• CVE-2026-66902 CRITICAL 9.8 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an
• CVE-2026-6847 CRITICAL 9.3 Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file
• CVE-2026-71231 CRITICAL 9.8 IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE
• CVE-2026-115806 CRITICAL 9.8 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi
• CVE-2026-12257 CRITICAL 9.3 Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability
• CVE-2026-16235 CRITICAL 9.8 Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use
• CVE-2026-28139 CRITICAL 9.8 Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
• CVE-2026-28149 CRITICAL 9.8 Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
• CVE-2026-32563 CRITICAL 9.8 Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
• CVE-2026-35052 CRITICAL 9.8 UPGRADE D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures
• CVE-2026-40725 CRITICAL 9.8 Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
• CVE-2026-42380 CRITICAL 9.8 Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.
• CVE-2026-49108 CRITICAL 9.8 Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
• CVE-2026-59144 CRITICAL 9.8 Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_s
• CVE-2026-59147 CRITICAL 9.8 Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidate
• CVE-2026-59544 CRITICAL 9.8 Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.
• CVE-2026-60366 CRITICAL 10.0 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-60367 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-60372 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Central
• CVE-2026-64625 CRITICAL 9.8 AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands i
• CVE-2026-65556 CRITICAL 9.8 Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
• CVE-2026-65571 CRITICAL 9.8 Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
• CVE-2026-65572 CRITICAL 9.8 Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
• CVE-2026-65574 CRITICAL 9.8 Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
• CVE-2026-65575 CRITICAL 9.8 Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
• CVE-2026-65576 CRITICAL 9.8 Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
• CVE-2026-65577 CRITICAL 9.8 Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
• CVE-2026-65579 CRITICAL 9.8 Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
• CVE-2026-65581 CRITICAL 9.8 Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
• CVE-2026-73341 CRITICAL 9.8 Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
• CVE-2026-73366 CRITICAL 9.8 Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
• CVE-2026-73376 CRITICAL 9.8 Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
• CVE-2026-73380 CRITICAL 9.8 Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
• CVE-2026-35029 HIGH 8.8 UPGRADE LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
• CVE-2026-47683 HIGH 8.7 vm2 is an open source vm/sandbox for Node.js
• CVE-2026-48158 CRITICAL 9.3 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19
• CVE-2026-48159 CRITICAL 9.3 use-reducer-async is a React useReducer with async actions
• CVE-2026-48160 CRITICAL 9.3 react-tracked provides state usage tracking with Proxies
• CVE-2026-54058 CRITICAL 9.1 UPGRADE Pillow is a Python imaging library
• CVE-2026-63106 CRITICAL 9.8 ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API
• CVE-2026-64796 CRITICAL 9.8 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not requ
• CVE-2026-70035 HIGH 8.8 Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a net
• CVE-2026-112408 HIGH 8.1 Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker
• CVE-2026-18245 CRITICAL 9.0 UPGRADE Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote
• CVE-2026-3031 CRITICAL 9.8 Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG inc
• CVE-2026-41608 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python binding
• CVE-2026-43871 HIGH 7.5 UPGRADE Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java
• CVE-2026-45112 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue
• CVE-2026-46633 CRITICAL 9.8 UPGRADE Twig is a template language for PHP
• CVE-2026-46634 CRITICAL 9.8 UPGRADE Twig is a template language for PHP
• CVE-2026-48586 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Pyt
• CVE-2026-49158 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
• CVE-2026-55968 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apac
• CVE-2026-69256 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-70159 HIGH 7.5 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s
• CVE-2026-96958 HIGH 7.5 UPGRADE DOWNGRADE Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96960 HIGH 7.5 UPGRADE DOWNGRADE Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a
• CVE-2023-23918 HIGH 7.5 UPGRADE A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it p
• CVE-2026-17552 CRITICAL 9.1 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_UR
• CVE-2026-32470 CRITICAL 9.8 Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
• CVE-2026-47731 CRITICAL 9.1 The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Py
• CVE-2026-48046 CRITICAL 9.3 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-49107 CRITICAL 9.8 Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.
• CVE-2026-53727 HIGH 8.6 DOWNGRADE css_parser is a Ruby CSS parser
• CVE-2026-56740 HIGH 7.5 UPGRADE JLine is a Java library for handling console input
• CVE-2026-65552 CRITICAL 9.8 Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
• CVE-2026-65573 CRITICAL 9.8 Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
• CVE-2026-65578 CRITICAL 9.8 Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
• CVE-2026-67195 HIGH 8.8 Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to exec
• CVE-2026-96639 CRITICAL 9.8 Pillow is a Python imaging library
• CVE-2023-22792 HIGH 7.5 UPGRADE A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1
• CVE-2025-66844 CRITICAL 9.1 UPGRADE In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page c
• CVE-2026-102870 HIGH 8.8 Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to e
• CVE-2026-13014 CRITICAL 9.2 A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker
• CVE-2026-15982 CRITICAL 9.8 The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is v
• CVE-2026-35164 HIGH 8.8 UPGRADE Brave CMS is an open-source CMS
• CVE-2026-45799 HIGH 7.5 UPGRADE Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java
• CVE-2026-48161 CRITICAL 9.3 react18-use is a React 19 use hook shim
• CVE-2026-52854 HIGH 8.6 Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps
• CVE-2026-53486 CRITICAL 9.1 The decompress package for Node.js extracts archives
• CVE-2026-54722 HIGH 8.7 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks

FAQ

How do I fix Programming languages and frameworks vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Programming languages and frameworks being exploited right now?

Yes: 5 Programming languages and frameworks CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Programming languages and frameworks CVE should I patch first?

CVE-2016-3081 currently ranks highest (93/100): Apache Struts Command Injection Vulnerability.

Software in this group

People search for: node, php, python, java, spring, log4j.

← Back to latest CVEs