Medium
CVE-2026-6910
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Medium
CVE-2026-8996
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
Medium
CVE-2026-7558
Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter
Unrated
CVE-2026-15089
drupal/commerce_guest_registration - SA-CONTRIB-2026-079
Unrated
CVE-2026-15087
drupal/clean_node_api - SA-CONTRIB-2026-078
Unrated
CVE-2026-15086
drupal/raw_formatter - SA-CONTRIB-2026-077
Unrated
CVE-2026-15085
drupal/ai_seo - SA-CONTRIB-2026-076
Unrated
CVE-2026-15084
drupal/ui_patterns - SA-CONTRIB-2026-075
Medium
CVE-2026-59930
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59926
Mistune: XSS via unescaped class option in Admonition directive
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Medium
CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path traversal
High
CVE-2026-59928
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Medium
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Medium
CVE-2026-59923
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Unrated
CVE-2026-15083
drupal/eca - SA-CONTRIB-2026-074
Unrated
CVE-2026-15082
drupal/siteimprove_analytics - SA-CONTRIB-2026-073
Unrated
CVE-2026-15081
drupal/location_selector - SA-CONTRIB-2026-072
Unrated
CVE-2026-15080
drupal/lingotek - SA-CONTRIB-2026-071
Unrated
CVE-2026-15079
drupal/login_disable - SA-CONTRIB-2026-070
Low
CVE-2026-14966
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.