High
CVE-2026-44175
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-44174
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
High
CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
High
CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
High
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Medium
CVE-2026-42568
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
High
CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
High
CVE-2026-42089
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
Medium
CVE-2026-41207
netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
Medium
CVE-2026-44899
Mistune Image Directive CSS Injection Vulnerability
Medium
CVE-2026-44898
Mistune TOC Anchor Injection XSS
Medium
CVE-2026-44897
Mistune Heading ID Attribute has Injection XSS
Medium
CVE-2026-44896
Mistune has XSS via unescaped figclass/figwidth in Figure directive
Medium
CVE-2026-44708
Mistune Math Plugin has an XSS Escape Bypass
Medium
CVE-2025-0898
Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG
Medium
CVE-2026-3348
MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-3349
MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter
Medium
CVE-2026-2288
myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter
Medium
CVE-2026-2280
rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
High
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
Medium
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
Low
CVE-2026-35202
Pterodactyl has a database resource limit bypass via race condition in Client API
Medium
CVE-2026-8906
WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter
Medium
CVE-2026-26028
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.