Medium
ghsa-j5qp-p44g-2m49
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
ghsa-2944-57xv-2682
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
Medium
ghsa-xw57-23p8-9wc5
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
Medium
ghsa-qcr8-x557-7cp3
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
Medium
CVE-2026-4804
Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
Medium
CVE-2026-11900
Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute
Medium
ghsa-5c7w-4wm3-85vw
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
High
CVE-2026-50288
@asymmetric-effort/specifyjs: URL parse failure silently allows request
High
CVE-2026-50284
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Medium
CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Medium
CVE-2026-50280
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
High
CVE-2026-50279
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Medium
CVE-2026-9230
Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure
High
CVE-2026-52854
mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function
Medium
CVE-2026-8351
RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
High
CVE-2026-9148
Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field
High
CVE-2026-53828
OpenClaw: Native command authorization could skip owner-command enforcement
High
CVE-2026-53836
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
High
CVE-2026-53839
OpenClaw: Trusted retry endpoint checks could match hostname prefixes
High
CVE-2026-53807
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
High
CVE-2026-53811
OpenClaw: Matrix allowFrom could bind to mutable display names
Medium
CVE-2026-53824
OpenClaw: Mattermost slash token revocation could lag until monitor refresh
High
CVE-2026-53816
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
High
CVE-2026-53806
OpenClaw: Combined POSIX shell options could confuse exec revalidation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.