Medium
CVE-2026-44584
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,530
Medium
CVE-2026-44583
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
Critical
CVE-2026-44203
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Medium
CVE-2026-44202
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Critical
CVE-2026-44179
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
High
CVE-2026-41573
OpenAM has LDAP Injection via `_queryId` Parameter
Medium
CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
High
CVE-2026-33692
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Medium
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Low
CVE-2026-54280
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Low
CVE-2026-54279
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Medium
CVE-2026-54278
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Medium
CVE-2026-54277
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Medium
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
High
CVE-2026-54283
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Low
CVE-2026-54282
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Low
CVE-2026-54275
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
Medium
CVE-2026-54273
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
Medium
CVE-2026-54274
aiohttp: Incomplete websocket frame payloads bypass memory limits
Low
CVE-2026-50269
aiohttp: CRLF injection in multipart headers
Medium
CVE-2026-33684
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
Critical
CVE-2025-58048
Paymenter vulnerable to Remote Code Execution via public file uploads
Medium
CVE-2026-44913
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.