Medium
CVE-2026-15100
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,406
Medium
CVE-2026-11354
Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Medium
CVE-2025-9205
MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-13464
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Medium
CVE-2026-6454
Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
High
CVE-2026-12736
WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Medium
CVE-2026-15420
Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
High
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
High
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Medium
CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Low
CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
High
Exploited in attacks
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Low
CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Medium
CVE-2026-54559
PocketSphinx: Buffer overflows in language and acoustic model loading code
High
CVE-2026-54549
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54567
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Critical
CVE-2026-61740
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Critical
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-54552
sh _uid does not drop supplementary groups (incomplete privilege drop)
Medium
CVE-2026-54503
plone.app.textfield: Stored XSS by spoofing mime type
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.