Medium
CVE-2026-104022
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,401
Medium
CVE-2026-62036
All Bootstrap Blocks <= 1.3.31 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-62040
Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization
Medium
CVE-2026-62028
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Missing Authorization
Medium
CVE-2026-62041
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization
Medium
CVE-2026-62026
Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery
Medium
CVE-2026-39779
Asgaros Forum <= 3.4.0 - Missing Authorization
Medium
CVE-2026-62049
JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-62042
Scripts n Styles <= 3.5.8 - Missing Authorization
Medium
CVE-2026-107719
fast-jwt: Verifier cache accepts expired JWTs without iat.
Critical
CVE-2026-107726
Hazelcast allows arbitrary member memory access by low-privileged client
Medium
CVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
Medium
CVE-2026-107717
Banks: User-controlled prompt input can be parsed as privileged chat messages
Medium
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check
Medium
CVE-2026-107395
Indico: Missing access check in legacy session export API
Medium
CVE-2026-107397
Indico: Cross-Site-Scripting in minutes editor
Medium
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields
High
CVE-2026-107725
Hazelcast has an authorization bypass in IMap Predicates API
Medium
CVE-2026-107718
AdonisJS: Unencoded route parameters can produce open redirects
High
CVE-2026-107720
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Critical
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
Medium
CVE-2026-107721
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
High
CVE-2026-107723
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
High
CVE-2026-107724
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.