Medium
CVE-2026-58481
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-58484
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
Medium
CVE-2026-57442
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
Low
ghsa-h5jc-78hr-3pc9
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe
High
CVE-2026-55878
symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest
Medium
CVE-2026-55877
symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
High
CVE-2026-55692
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
Medium
CVE-2026-55650
Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Medium
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Medium
CVE-2026-100725
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
High
ghsa-m4w9-hjfw-vwj4
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
Medium
CVE-2026-100724
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
Medium
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Medium
CVE-2026-55846
Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
High
ghsa-rpj2-4hq8-938g
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
High
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
High
ghsa-8823-qg2x-pv9f
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
High
CVE-2026-55660
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
Medium
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Medium
ghsa-78vr-q6cf-c7p6
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
Critical
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
High
CVE-2026-54074
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
High
CVE-2026-55691
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.