High
CVE-2026-48921
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,533
Medium
CVE-2026-9704
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input
Medium
CVE-2026-9228
Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
High
CVE-2026-2374
Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF
Medium
CVE-2026-5737
Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route
High
CVE-2026-7802
Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
Medium
CVE-2026-9241
FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter
Medium
CVE-2026-47104
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB
Medium
CVE-2026-23679
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface clai
Medium
CVE-2026-9689
Keycloak Services has Improper Validation of Consistency within Input
Medium
CVE-2026-4888
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending
High
CVE-2026-49014
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer witho
Medium
CVE-2026-44979
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
High
CVE-2026-44974
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
High
CVE-2026-44741
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
High
CVE-2026-44739
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
High
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Medium
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Medium
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Critical
CVE-2026-44632
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
Medium
CVE-2026-44596
Yamcs has No Rate Limiting on Authentication Endpoint
Medium
CVE-2026-44595
Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints
Medium
CVE-2026-49053
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.