Medium
CVE-2026-48492
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Low
CVE-2026-48488
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
Medium
CVE-2026-48480
OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
Medium
CVE-2026-48167
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
Medium
CVE-2026-48166
Filament: Timing-based user enumeration on login page
Medium
CVE-2026-48157
Slim has Reflected XSS in the HtmlErrorRenderer
High
CVE-2026-41862
Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
Medium
CVE-2026-54517
jackson-databind has @JsonView bypass for setterless creator properties
Medium
CVE-2026-54516
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Medium
CVE-2026-54515
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Medium
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
High
CVE-2026-54513
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
High
CVE-2026-54512
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
Medium
CVE-2026-50193
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
Medium
CVE-2026-54518
jackson-databind has a @JsonView bypass for unwrapped creator parameters
High
CVE-2026-53755
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
High
CVE-2026-53754
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)
Medium
CVE-2026-60092
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
Critical
ghsa-phv5-334h-mxcw
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
Critical
ghsa-qxvg-h7q2-hcxh
motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)
High
CVE-2026-54317
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Critical
CVE-2026-54350
Budibase has nonymous NoSQL operator injection via published-app query templates
High
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
High
CVE-2026-45049
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.