Unrated
CVE-2026-81161
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Unrated
CVE-2026-81159
drupal/commerce_cybersource - SA-CONTRIB-2026-106
Unrated
CVE-2026-81168
drupal/captcha_protected_page - SA-CONTRIB-2026-105
Unrated
CVE-2026-81165
drupal/blazy - SA-CONTRIB-2026-104
Unrated
CVE-2026-81167
drupal/address_suggestion - SA-CONTRIB-2026-103
Medium
CVE-2026-54614
cakephp/debug_kit: MailPreview contains unsafe reflection
High
CVE-2026-54606
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
Medium
ghsa-x287-5c68-36wp
OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses
Critical
ghsa-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
Medium
CVE-2026-55688
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
High
CVE-2026-54511
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
High
CVE-2026-54550
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries
High
CVE-2026-54556
http4s has HTTP/2 Denial of Service with Ember Backend
High
CVE-2026-54356
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
High
CVE-2026-80206
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
High
CVE-2026-80205
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
High
CVE-2026-15990
Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
Critical
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
Critical
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Critical
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
Medium
CVE-2026-81278
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
Medium
CVE-2026-19226
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-13406
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Missing Authorization
Medium
CVE-2026-78276
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.