High
CVE-2026-85568
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,515
Medium
CVE-2026-96962
Pie Register <= 3.8.4.13 - Unauthenticated Information Exposure
Medium
CVE-2026-86833
MetForm <= 4.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Emails
Medium
CVE-2026-86834
MetForm 2.2.1 - 4.3.0 - Unauthenticated Information Exposure
Medium
CVE-2026-94239
Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting
High
CVE-2026-101889
Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary Directory Deletion
Medium
CVE-2026-80518
Ultimate CSV Importer <= 9.1 - Unauthenticated Information Exposure
Critical
CVE-2026-95588
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-101890
Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2026-102930
Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Medium
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
Medium
CVE-2026-92081
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Medium
CVE-2026-103261
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
High
CVE-2026-103262
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
High
CVE-2026-103263
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Medium
CVE-2026-100689
GitPython submodule update path traversal can write outside the repository
Medium
CVE-2026-93981
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
Medium
CVE-2026-102983
Astro: Netlify Image CDN allowlist bypass enables SSRF
High
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
High
CVE-2026-92144
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.