Medium
CVE-2026-74929
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-15985
Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
Critical
CVE-2026-18080
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
Medium
CVE-2026-2388
Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2026-65087
NVIDIA NemoClaw contains a vulnerability where an attacker could cause
Medium
CVE-2026-54338
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Medium
CVE-2026-55605
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint
High
CVE-2026-55604
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
High
CVE-2026-55609
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
High
CVE-2026-55629
Whistle vulnerable to path traversal
Medium
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
Critical
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
High
CVE-2026-18331
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
High
ghsa-vwf3-4xxj-qg6h
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
High
CVE-2026-57995
phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
Medium
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
Medium
CVE-2026-57961
phpMyFAQ has Potential Authenticated Path Traversal in PDF Export
High
CVE-2026-19760
WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
High
CVE-2026-55596
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
High
CVE-2026-55557
browse-mcp has an arbitrary file write via unconfined download and state paths
High
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Critical
CVE-2026-79675
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
High
CVE-2026-79676
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
High
CVE-2026-79674
NLTK: Corpus Reader Sandbox Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.