Critical
CVE-2026-49257
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-49252
deepstream is vulnerable to prototype pollution
Medium
ghsa-75mw-h36v-2jv7
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Medium
CVE-2026-74783
Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)
Medium
CVE-2026-73062
Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx
Medium
ghsa-q683-8468-r6h6
WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs
Medium
CVE-2026-48820
CakePHP: View::element() is missing a path containment check
High
ghsa-3p34-w4f6-5xh2
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
High
CVE-2026-48979
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
High
ghsa-fhp4-pr5j-46m5
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
High
CVE-2026-48801
LinkifyIt#match scan loop has quadratic algorithmic complexity
Medium
ghsa-m8j6-rc5x-wv36
nono-py's policy JSON accepts unknown security fields
Medium
ghsa-9j7f-3r4p-pwh6
nono-py vulnerable to authorization bypass / policy confusion
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
ghsa-72w7-mf9g-733p
nono-py has proxy-only network fallback bypass on older Linux kernels
Medium
ghsa-5vwr-qchf-q4pf
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
Medium
CVE-2026-48782
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Medium
CVE-2026-48758
@sigstore/core has DSSE payloadType type-binding failure
High
CVE-2026-56876
extract-zip unvalidated symlink path traversal
Medium
CVE-2026-11779
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts
Medium
CVE-2026-9242
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
Medium
CVE-2026-12432
Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.