Medium
CVE-2026-59903
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler
High
CVE-2026-55090
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Medium
ghsa-92hr-gmr6-h8cp
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
High
CVE-2026-92961
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
Critical
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Critical
CVE-2026-47698
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
Critical
CVE-2026-47686
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
High
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Medium
CVE-2026-74004
Gravity Booster – Styles & Layouts for Gravity Forms <= 6.1 - Missing Authorization
Medium
CVE-2026-74003
RTMForm Builder <= 1.2.7 - Missing Authorization
Medium
CVE-2026-74006
WP Table Builder – Drag & Drop Table Builder <= 2.2.0 - Missing Authorization
Medium
CVE-2026-74007
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 - Unauthenticated Information Exposure
Medium
CVE-2026-74008
Shortcodes and extra features for Phlox theme <= 2.17.22 - Unauthenticated Information Exposure
Medium
CVE-2026-74009
Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
Critical
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
High
CVE-2026-19693
extract-zip allows arbitrary file writes through symlink archive entries
High
CVE-2026-53728
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
High
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
High
CVE-2026-11801
WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
High
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
High
CVE-2026-73393
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-32549
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
High
CVE-2026-73339
Modern Events Calendar < 7.35.0 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.