Medium
CVE-2026-16684
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-15018
Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
Medium
CVE-2026-17580
Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints
Medium
CVE-2026-65841
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
High
CVE-2026-58263
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Medium
CVE-2026-54756
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
Medium
CVE-2026-62324
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
High
CVE-2026-15988
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
Medium
CVE-2026-2916
Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
Medium
CVE-2025-14469
Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification
High
CVE-2026-54737
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
Critical
CVE-2026-3141
FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
High
CVE-2026-55100
hashi-vault-js has a path traversal and query parameter injection
High
CVE-2026-54729
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Medium
CVE-2026-67550
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
Medium
CVE-2026-68499
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
Medium
CVE-2026-68501
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
High
CVE-2026-68500
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Medium
CVE-2026-54753
`nx graph` dev server permissive CORS policy
High
CVE-2026-41695
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
High
ghsa-p7w7-4929-vpj5
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Medium
ghsa-xrmj-5g4g-8987
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Medium
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.