Medium
CVE-2026-39389
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-40180
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Unrated
CVE-2026-6095
drupal/orejime - SA-CONTRIB-2026-032
Medium
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Medium
CVE-2026-5600
A new API endpoint introduced in pretix 2025 that is supposed to
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Medium
CVE-2026-39859
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Medium
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Low
CVE-2026-34166
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
High
CVE-2026-33229
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
Medium
CVE-2026-5742
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
Critical
CVE-2026-1830
Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
Medium
CVE-2026-4336
Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
Medium
CVE-2026-5357
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-5711
Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute
High
CVE-2026-5436
MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
Medium
CVE-2026-0811
Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
Medium
CVE-2026-0814
Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export
Critical
CVE-2026-2942
ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess
Medium
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Medium
CVE-2026-39409
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Medium
CVE-2026-56762
Hono missing validation of cookie name on write path in setCookie()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.