High
CVE-2020-26710
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2020-26709
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Low
ghsa-373w-rj84-pv6x
SafeURL-Python's hostname blocklist does not block FQDNs
Critical
CVE-2023-3249
Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass
High
CVE-2023-3063
SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
Critical
CVE-2023-3460
Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates
High
CVE-2023-3343
User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2023-34099
Shopware improper mail validation vulnerability
Medium
CVE-2023-34098
Shopware dependency configuration exposed
Unrated
drupal-contrib-2023-029
drupal/tacjs - SA-CONTRIB-2023-029
Unrated
drupal-contrib-2023-028
drupal/expandable_formatter - SA-CONTRIB-2023-028
Unrated
drupal-contrib-2023-027
drupal/libraries_ui - SA-CONTRIB-2023-027
Unrated
drupal-contrib-2023-026
drupal/search_autocomplete - SA-CONTRIB-2023-026
Unrated
drupal-contrib-2023-025
drupal/mailchimp - SA-CONTRIB-2023-025
Unrated
drupal-contrib-2023-024
drupal/gridstack - SA-CONTRIB-2023-024
Unrated
drupal-contrib-2023-023
drupal/gdpr_alert - SA-CONTRIB-2023-023
High
CVE-2023-26134
git-commit-info vulnerable to Command Injection
Medium
CVE-2023-23798
Layer Slider <= 1.1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2023-3447
Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection
Medium
CVE-2023-25471
WCP OpenWeather <= 2.5.0 - Reflected Cross-Site Scripting via 'tab'
Medium
CVE-2023-36531
LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68 - Missing Authorization via activate_addon
Medium
CVE-2023-1602
Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting
High
CVE-2023-36381
Zippy <= 1.6.5 - Authenticated(Author+) PHP Object Injection via unzipPosts
High
CVE-2022-46860
Short URL <= 1.6.4 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.