High
CVE-2026-56037
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-11563
Word Count and Social Shares <= 1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-56032
BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-56027
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload
Medium
CVE-2026-56029
CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization
Medium
CVE-2026-11567
SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass
Medium
CVE-2025-15665
BEAF <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-56034
Library Management System <= 3.5.7 - Unauthenticated SQL Injection
Medium
CVE-2026-50179
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
High
CVE-2026-54353
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
Critical
CVE-2026-54352
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
High
CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
High
CVE-2026-49229
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
High
CVE-2026-50137
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Medium
CVE-2026-47155
vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors
High
CVE-2026-41523
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
High
CVE-2026-54232
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package.
Critical
CVE-2026-48746
vLLM: OpenAI auth bypass
High
CVE-2026-50136
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
High
CVE-2026-50132
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
Medium
ghsa-hvqh-jw65-wcpq
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
Critical
CVE-2026-48170
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
High
CVE-2026-48153
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
Medium
CVE-2026-54911
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.