Medium
CVE-2026-39628
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-1671
Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
Medium
CVE-2026-1356
Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
High
CVE-2026-25990
Pillow affected by out-of-bounds write when loading PSD images
Medium
CVE-2025-69874
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
High
CVE-2026-25759
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
Unrated
CVE-2026-2349
drupal/ui_icons - SA-CONTRIB-2026-010
Medium
CVE-2026-25633
Statamic CMS's missing authorization allows access to assets
Unrated
CVE-2026-2348
drupal/quickedit - SA-CONTRIB-2026-009
Medium
CVE-2018-25157
Phraseanet vulnerable to stored cross-site scripting through crafted file names
Medium
CVE-2019-25317
Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions
Critical
CVE-2026-26021
set-in Affected by Prototype Pollution
Medium
CVE-2026-26019
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
High
CVE-2026-26010
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Medium
CVE-2026-1537
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
Critical
CVE-2026-1729
AdForest <= 6.0.12 - Authentication Bypass
Medium
CVE-2026-32348
MAS Videos <= 1.3.2 - Missing Authorization
High
CVE-2025-69405
Lorem Ipsum | Books & Media Store <= 1.2.6 - Unauthenticated PHP Object Injection
High
CVE-2025-68526
Modal Popup Box <= 1.6.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-39625
TechOne <= 3.0.3 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2025-69400
Yokoo <= 1.1.11 - Unauthenticated Local File Inclusion
High
CVE-2025-69404
Extreme Store <= 1.5.7 - Unauthenticated PHP Object Injection
Medium
CVE-2025-69401
WooODT Lite <= 2.5.5 - Unauthenticated Payment Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.