Low
CVE-2026-84307
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-77567
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
Medium
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
High
CVE-2026-86428
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
High
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
High
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
High
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Medium
CVE-2026-91990
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Low
CVE-2026-91991
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
High
CVE-2026-73086
nanoid: Integer Overflow or Wraparound
High
CVE-2026-101043
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
Medium
CVE-2025-7963
Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
High
ghsa-2rx9-3g3h-c2jv
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
High
CVE-2026-75528
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Medium
CVE-2026-58191
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Medium
CVE-2026-3850
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
High
ghsa-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
Critical
CVE-2026-78657
SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
High
CVE-2026-14357
DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
High
CVE-2026-73089
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
High
CVE-2026-73088
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
High
ghsa-3f6p-5ww8-9rcr
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
Medium
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Medium
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.