High
ghsa-fhp4-pr5j-46m5
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,532
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
High
CVE-2026-48801
LinkifyIt#match scan loop has quadratic algorithmic complexity
Medium
ghsa-m8j6-rc5x-wv36
nono-py's policy JSON accepts unknown security fields
Medium
ghsa-9j7f-3r4p-pwh6
nono-py vulnerable to authorization bypass / policy confusion
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
ghsa-72w7-mf9g-733p
nono-py has proxy-only network fallback bypass on older Linux kernels
Medium
ghsa-5vwr-qchf-q4pf
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
Medium
CVE-2026-48782
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Medium
CVE-2026-48758
@sigstore/core has DSSE payloadType type-binding failure
High
CVE-2026-56876
extract-zip unvalidated symlink path traversal
Medium
CVE-2026-11779
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts
Medium
CVE-2026-9242
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
Medium
CVE-2026-12432
Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
Medium
CVE-2026-9233
Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
Medium
CVE-2026-11364
Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions
Medium
CVE-2026-11773
Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
Medium
CVE-2026-11987
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Medium
CVE-2026-11783
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Medium
CVE-2026-12399
Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
Medium
CVE-2026-53463
ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
Medium
CVE-2026-11597
Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-12471
Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.