Medium
CVE-2025-14778
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2026-1486
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
High
CVE-2026-1529
Keycloak affected by improper invitation token validation
High
CVE-2026-1866
Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
High
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Medium
CVE-2026-1922
The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
High
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2026-25497
Craft CMS: GraphQL Asset Mutation Privilege Escalation
Medium
CVE-2026-25496
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
High
CVE-2026-25495
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Medium
CVE-2026-25494
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
Medium
CVE-2026-25493
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
Medium
CVE-2026-25492
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Low
CVE-2026-25491
Craft CMS Vulnerable to Stored XSS in Entry Types Name
Medium
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
Medium
CVE-2026-25480
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Medium
CVE-2026-25479
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
High
CVE-2026-25478
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Medium
CVE-2026-1722
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
High
CVE-2026-25639
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Medium
CVE-2026-0996
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
Medium
CVE-2026-23903
Apache Shiro has an Authentication Bypass
High
CVE-2026-0845
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.