Unrated
pysec-2026-593
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Unrated
pysec-2026-592
Malicious code in magique (PyPI)
Unrated
pysec-2026-591
Malicious code in funcdesc (PyPI)
Unrated
pysec-2026-590
Malicious code in executor-http (PyPI)
Medium
CVE-2026-12754
VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter
Medium
CVE-2026-13454
MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
Unrated
pysec-2026-589
Malicious code in executor-engine (PyPI)
High
CVE-2026-12158
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
Medium
CVE-2026-12408
Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
Medium
CVE-2026-55219
Paymenter has race condition in payWithCredit() that enables credit double-spend
Critical
CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Medium
CVE-2026-10096
Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Medium
CVE-2026-12435
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
Medium
CVE-2026-12732
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
Medium
CVE-2026-13733
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Medium
CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Medium
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
Medium
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
Low
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Medium
CVE-2026-48796
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
High
CVE-2026-48795
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
High
CVE-2026-58168
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Low
CVE-2026-48791
Sigstore Java has a vulnerability with bundle verification of integratedTime
High
CVE-2026-49473
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.