High
CVE-2026-39363
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Critical
CVE-2026-35035
CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
Medium
CVE-2026-34756
vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
Medium
CVE-2026-34755
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
Critical
CVE-2026-0740
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
Low
CVE-2026-37977
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
Low
CVE-2026-5602
@nor2/heim-mcp vulnerable to command injection
Low
CVE-2026-5603
@elgentos/magento2-dev-mcp vulnerable to command injection
Medium
CVE-2025-14944
Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
Medium
CVE-2026-34888
Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure
Medium
CVE-2026-34891
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
Medium
CVE-2026-34897
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-34885
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2016-20054
Nodcms contains a cross-site request forgery vulnerability
Critical
CVE-2026-35459
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
High
CVE-2026-34511
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
High
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
Medium
CVE-2026-35452
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
Medium
CVE-2026-35450
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
Medium
CVE-2026-35449
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
Low
CVE-2026-35448
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.