High
CVE-2026-59214
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-59218
Open WebUI: Account enumeration via observable login timing discrepancy
Medium
CVE-2026-59938
pypdf: Possible large memory usage for wrong image dimensions
High
CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline images
Low
CVE-2026-63632
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
Medium
CVE-2026-49138
Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
Low
CVE-2026-11466
zilliztech deep-searcher has an Incorrect Privilege Assignment issue
Medium
CVE-2026-59937
pypdf: Possible long runtimes for repeated malformed cross-reference entries
Low
CVE-2026-11529
MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
High
CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Medium
CVE-2026-52902
awxkit has a path traversal vulnerability
Medium
CVE-2026-10221
hermes-agent has an Injection issue
Medium
CVE-2026-10224
hermes-agent has an Uncontrolled Resource Consumption issue
Low
CVE-2026-10223
hermes-agent has an Injection issue
Medium
CVE-2026-14317
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass
Medium
CVE-2026-14830
FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-17017
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-17541
Bit File Manager <= 6.9.0 - Unauthenticated File Activity Log Disclosure
High
CVE-2026-27096
ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-18030
Bricksforge <= 3.1.8.7 - Unauthenticated Privilege Escalation via Password Reset
High
CVE-2026-12720
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28140
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.4.1 - Missing Authorization
High
CVE-2026-13392
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor < 3.10.01 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-14928
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Authenticated (Subscriber+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.