Medium
CVE-2026-106603
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,515
Medium
CVE-2026-103072
VillaTheme Core <= 1.0.5 - Missing Authorization
Medium
CVE-2026-105078
WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-103692
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Information Exposure
Medium
CVE-2026-62127
WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-61439
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
High
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
High
CVE-2026-105643
Ghost: Stored XSS via Embed Card Previews
Medium
CVE-2026-105644
Ghost : Stored XSS via SVG Files in Content Imports
Medium
CVE-2026-105645
Ghost: Regular Expression Denial of Service in External Media Inliner
Medium
CVE-2026-105646
Ghost: Regular Expression Denial of Service in Content Import
Medium
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
Medium
CVE-2026-105748
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Critical
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Medium
CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
High
CVE-2026-106451
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
Low
CVE-2026-106449
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
Medium
CVE-2026-106450
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
Medium
CVE-2026-105647
Ghost: Server-Side Request Forgery in Bookmark Fetching
Medium
CVE-2026-105648
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
High
CVE-2026-105649
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
High
CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Medium
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.