High
CVE-2026-11589
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2017-20250
Mac Photo Gallery <= 3.0 - Unauthenticated Arbitrary File Deletion
High
CVE-2017-20246
KittyCatfish <= 2.2 - Unauthenticated SQL Injection
High
CVE-2017-20243
Car Park Booking System <= 1.0 - Unauthenticated SQL Injection
High
CVE-2017-20248
Apptha Slider Gallery <= 1.0 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-49068
Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.8.1 - Authenticated (Subscriber+) Information Exposure
High
CVE-2016-20062
Simply Poll <= 1.4.1 - Unauthenticated SQL Injection
Medium
CVE-2026-47721
FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Medium
CVE-2026-47720
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
High
CVE-2026-47719
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Medium
CVE-2026-47693
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
High
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
Medium
CVE-2026-47244
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
High
CVE-2026-46340
Netty: SCTP reassembly nests buffers without bound
High
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Medium
CVE-2026-45673
Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
Medium
CVE-2026-45536
Netty: Unix-socket fd receive leaks descriptors when peer sends two at once
High
CVE-2026-45416
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Critical
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
High
CVE-2026-44894
Netty's Default QUIC token handler accepts any client-supplied token
Medium
CVE-2026-4058
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
High
CVE-2026-8365
Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
Medium
CVE-2026-8677
Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings
Medium
CVE-2026-8599
MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.