Medium
CVE-2026-14211
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-66431
Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 - Missing Authorization
Medium
CVE-2026-66454
WP Social Avatar <= 1.5 - Missing Authorization
Medium
CVE-2026-72779
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium
CVE-2026-72782
Craft CMS: Authenticated leak of secret environment variables
Medium
CVE-2026-72785
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Medium
CVE-2026-14794
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
Low
CVE-2026-72783
Craft CMS: Incorrect path validation could potentially lead to path traversal
Medium
CVE-2026-72787
Craft CMS: Stored XSS in the control panel via unescaped draft name
High
CVE-2026-67434
PHP_CodeSniffer gitblame report command injection via crafted filename
Medium
CVE-2026-71498
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
Medium
CVE-2026-71430
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
High
ghsa-w9hm-4m3m-fxmm
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
High
CVE-2026-16633
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
Medium
CVE-2026-71497
jsoup: Cleaner may expose markup with custom raw-text elements
High
CVE-2026-72786
Craft CMS: Arbitrary user password reset leading to administrator account takeover
High
CVE-2026-72781
Craft CMS: Authenticated RCE through Twig sandbox escape
Medium
CVE-2026-14793
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
High
CVE-2026-72778
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Medium
ghsa-mj63-m3rc-8ppr
league/commonmark: Denial of service via deeply nested XML output
High
CVE-2026-86434
league/commonmark: Denial of service via colliding heading slugs
High
ghsa-jfm3-95jq-q3rf
league/commonmark: Denial of service via duplicate footnote definitions
High
ghsa-g2gp-3wwq-f4ph
league/commonmark: Denial of service via adjacent inline attribute blocks
High
CVE-2026-71488
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.