Medium
CVE-2025-69872
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-26057
Skill-scanner Unsecured Network Binding Vulnerability
High
CVE-2026-25650
MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token
Medium
CVE-2026-25905
MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability
Medium
CVE-2026-25904
MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access
Low
CVE-2026-26013
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
High
CVE-2026-25577
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service
Medium
CVE-2026-25198
web2py has an Open Redirect Vulnerability
High
CVE-2026-1707
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
High
CVE-2023-25673
TensorFlow has Floating Point Exception in TensorListSplit with XLA
High
CVE-2023-25676
TensorFlow has null dereference on ParallelConcat with XLA
High
CVE-2023-25675
TensorFlow has Segfault in Bincount with XLA
High
CVE-2023-25658
TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad
High
CVE-2023-27579
TensorFlow has Floating Point Exception in TFLite in conv kernel
Medium
CVE-2026-7640
WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Medium
CVE-2026-11802
FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
Medium
CVE-2026-11390
News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
Medium
CVE-2026-49876
Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino.
Critical
CVE-2026-41041
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.
Medium
CVE-2026-12536
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Medium
CVE-2026-12385
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
Medium
CVE-2026-14847
Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure
Medium
CVE-2026-14831
Easy Booking <= 3.4.0 - Unauthenticated Minimum Booking Bypass
High
CVE-2026-4110
Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.