Medium
CVE-2026-9062
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-42685
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40864
JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-6895
Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action
High
CVE-2026-6897
Wishlist Member <= 3.32.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action
High
CVE-2026-6898
WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action
High
CVE-2026-6419
Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action
High
CVE-2026-9284
WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure
Critical
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
Medium
CVE-2026-47166
ImageMagick: Heap Buffer Over-Read in distributed pixel cache server
Medium
CVE-2026-47165
ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model
Medium
CVE-2026-46693
ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking
Medium
CVE-2026-46692
ImageMagick: Heap Buffer Over-Write in distributed pixel cache server
Medium
Exploited in attacks
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Low
CVE-2026-8416
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
Low
CVE-2026-8413
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
Medium
CVE-2026-8245
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination
Low
CVE-2026-8432
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()
Medium
CVE-2026-8337
Concrete CMS is vulnerable to IDOR in surveys
Low
CVE-2026-8409
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
Low
CVE-2026-8435
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()
Low
CVE-2026-8412
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
Low
CVE-2026-8410
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.