Medium
CVE-2026-77528
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-77426
Unleash: Missing await on permission check + cross-project IDOR in admin API
Medium
CVE-2026-77425
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
Medium
CVE-2026-76910
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Low
CVE-2026-76909
Unleash: CR-approval email renders user-controlled raw HTML
Medium
CVE-2026-75510
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Medium
CVE-2026-69190
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Medium
CVE-2026-65829
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
High
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
Medium
CVE-2026-63628
mppx: Gas Draining with access list
Medium
CVE-2026-63627
mppx: Gas Draining with padding
High
CVE-2026-63116
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
High
CVE-2026-62985
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
High
CVE-2026-93368
Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
Medium
CVE-2026-6831
Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
Medium
CVE-2026-56682
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
High
CVE-2026-56681
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
Medium
CVE-2026-61612
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Medium
CVE-2026-58272
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Medium
CVE-2026-58270
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
High
CVE-2026-58269
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Medium
CVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
High
CVE-2026-61647
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
Medium
CVE-2026-95586
Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.