Medium
CVE-2026-50183
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
High
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
High
CVE-2026-47696
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
Medium
CVE-2026-47694
WWBN AVideo: Stored XSS via unescaped Gallery category description
Critical
CVE-2026-50076
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
Medium
CVE-2026-47676
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Medium
CVE-2026-47674
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Medium
CVE-2026-47675
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Medium
CVE-2026-47673
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
Medium
CVE-2026-47672
epa4all-client: Unauthenticated REST API for Patient Record Writes
High
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Medium
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Medium
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Low
CVE-2026-45739
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
High
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
High
CVE-2026-44488
Allocation of Resources Without Limits or Throttling in Axios
High
CVE-2026-44487
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
High
CVE-2026-44486
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Medium
CVE-2026-10804
A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation le
Low
CVE-2026-10803
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipul
Low
CVE-2026-10802
Keystone: GraphQL API Endpoint Lacks Query Depth Limits
High
CVE-2026-10586
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.