Unrated
CVE-2026-15086
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Unrated
CVE-2026-15085
drupal/ai_seo - SA-CONTRIB-2026-076
Unrated
CVE-2026-15084
drupal/ui_patterns - SA-CONTRIB-2026-075
Medium
CVE-2026-59930
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59926
Mistune: XSS via unescaped class option in Admonition directive
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Medium
CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path traversal
High
CVE-2026-59928
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Medium
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Medium
CVE-2026-59923
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Unrated
CVE-2026-15083
drupal/eca - SA-CONTRIB-2026-074
Unrated
CVE-2026-15082
drupal/siteimprove_analytics - SA-CONTRIB-2026-073
Unrated
CVE-2026-15081
drupal/location_selector - SA-CONTRIB-2026-072
Unrated
CVE-2026-15080
drupal/lingotek - SA-CONTRIB-2026-071
Unrated
CVE-2026-15079
drupal/login_disable - SA-CONTRIB-2026-070
Low
CVE-2026-14966
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the
Low
CVE-2026-14967
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY
High
CVE-2026-15035
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing
Medium
CVE-2026-12002
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
Critical
CVE-2026-13423
Streamit <= 4.5.0 - Unauthenticated Remote Code Execution
Medium
CVE-2026-57421
CRM Perks Forms <= 1.1.7 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.