High
CVE-2026-55405
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Unrated
CVE-2026-55809
drupal/flag_attendance_field - SA-CONTRIB-2026-049
Unrated
CVE-2026-12535
drupal/formatter_field - SA-CONTRIB-2026-048
High
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Medium
CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Medium
CVE-2026-41280
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
Medium
CVE-2026-42357
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Critical
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
Critical
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
High
CVE-2026-11395
CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
Medium
CVE-2026-12111
Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
Medium
CVE-2026-9595
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
High
CVE-2026-5079
Multer vulnerable to Denial of Service via deeply nested field names
Medium
CVE-2026-12098
PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
Medium
CVE-2026-5038
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Low
CVE-2026-12102
UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
Medium
CVE-2026-54316
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
High
CVE-2026-53840
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Medium
CVE-2026-12136
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-12137
SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter
Medium
CVE-2026-10736
Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
Medium
CVE-2026-12093
Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
Medium
CVE-2026-11402
Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute
Medium
CVE-2026-10623
PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.