Medium
CVE-2026-34740
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-34739
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
Medium
CVE-2026-34738
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
Medium
CVE-2026-34737
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
Medium
CVE-2026-34733
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
Medium
CVE-2026-34732
AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
High
CVE-2026-34731
AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
Medium
CVE-2026-34716
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
Medium
CVE-2026-34613
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
Medium
ghsa-5qvp-pr9f-2g2v
poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645
Medium
CVE-2026-34611
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
Medium
ghsa-qc22-xmq4-qg46
c2cciutils affected by CVE-2022-40896
High
CVE-2026-34236
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
High
CVE-2026-29782
OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
High
CVE-2026-28805
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
Medium
CVE-2026-0688
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-0686
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
Unrated
CVE-2026-35000
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPat
High
CVE-2026-5032
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
Medium
CVE-2026-2265
Replicator deserializes untrusted user input
Medium
CVE-2026-34446
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
High
CVE-2026-34445
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
Medium
CVE-2026-34447
ONNX: External Data Symlink Traversal
High
CVE-2026-27489
onnx Vulnerable to Path Traversal via Symlink
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.