Medium
CVE-2026-7621
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,533
High
CVE-2026-45357
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
Medium
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
High
CVE-2026-9009
Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute
Medium
CVE-2026-7533
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
High
CVE-2026-45260
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Medium
CVE-2026-9644
LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-45162
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Medium
CVE-2026-45065
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
High
CVE-2026-45063
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Medium
CVE-2026-9674
Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability
Medium
CVE-2026-48927
Jenkins buildgraph-view Plugin does not escape the build URL
Medium
CVE-2026-48926
Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint
Medium
CVE-2026-48925
Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability
Medium
CVE-2026-48924
Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
Medium
CVE-2026-48923
Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation
Medium
CVE-2026-48545
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across
High
CVE-2026-48922
Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials
Medium
CVE-2026-48919
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Medium
CVE-2026-48918
Jenkins Active Directory Plugin follows LDAP referrals by default
High
CVE-2026-48920
Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem
Medium
CVE-2026-48917
Jenkins LDAP Plugin deserializes data from LDAP referrals without validation
Medium
CVE-2026-48916
Jenkins LDAP Plugin follows LDAP referrals
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.