High
ghsa-2mhw-8qcg-gr96
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
High
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
Medium
CVE-2026-33297
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
Low
CVE-2026-33296
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
High
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Medium
CVE-2026-33294
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
High
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
High
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
High
CVE-2026-32935
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
Critical
CVE-2026-4038
Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call
Medium
CVE-2026-4136
Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Medium
CVE-2026-56346
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
Medium
CVE-2026-33319
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
Medium
CVE-2026-33238
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
Medium
CVE-2026-33237
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
High
CVE-2026-33068
Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
Medium
CVE-2025-15363
Get Use APIs – JSON Content Importer < 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39562
Client Invoicing by Sprout Invoices <= 20.8.10 - Missing Authorization
Medium
CVE-2026-39521
Nelio Content <= 4.3.1 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2025-14545
YML for Yandex Market < 5.0.26 - Authenticated (Shop Manager+) Remote Code Execution
High
CVE-2026-3658
Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter
Low
CVE-2026-32722
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.