Medium
CVE-2026-10779
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-54005
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
Medium
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
High
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-49274
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
Medium
CVE-2026-53861
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-58653
praisonai-platform: Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
Medium
CVE-2026-57441
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
Medium
CVE-2026-57204
pypdf: Missing stream length values ignore defined limits
High
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Medium
CVE-2026-9678
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
High
CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
High
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Critical
CVE-2026-47103
python-statemachine SCXML <data expr> Eval Injection
Medium
CVE-2026-65898
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
High
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
High
CVE-2026-57137
npm PraisonAI AgentLoop onToolCall approval runs after tool execution
Critical
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
Critical
CVE-2026-57140
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.