Medium
CVE-2026-59899
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
High
CVE-2026-56822
Netty: TOCTOU in OcspServerCertificateValidator
High
CVE-2026-56821
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-56817
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Medium
CVE-2026-56746
Netty: Security Control Bypass via CORS Short-Circuit Failure
High
CVE-2026-56745
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Medium
CVE-2026-56722
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
High
CVE-2026-55851
Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
High
CVE-2026-55833
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
High
CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded settings map
Low
CVE-2026-55555
Dompdf: File existence oracle via font-face stylesheet declaration
Low
CVE-2026-55554
Dompdf: Chroot Validation Bypass
Medium
CVE-2026-15348
Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
Medium
CVE-2026-15448
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
Medium
CVE-2026-13119
Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter
Critical
CVE-2026-15015
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
High
CVE-2026-15017
MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers
Medium
CVE-2026-15394
Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
Medium
CVE-2026-13009
AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
Medium
CVE-2026-15786
WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter
Medium
CVE-2026-16078
WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.