Medium
CVE-2026-45785
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-45773
Turbo: Login callback CSRF/session fixation
Low
CVE-2026-45772
Turbo: Unexpected local code execution during Yarn Berry detection
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
High
CVE-2026-6009
Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)
Critical
CVE-2026-31072
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
High
CVE-2026-31069
BillaBear is Vulnerable to SQL Injection in the EventRepository
High
CVE-2026-5200
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
Medium
CVE-2026-6405
Anomify AI <= 0.3.6 - Cross-Site Request Forgery
Medium
CVE-2026-2955
AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header
Medium
CVE-2026-6566
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
Medium
CVE-2026-46341
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
High
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-46424
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
High
CVE-2026-7522
Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
Medium
CVE-2026-46337
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
Medium
CVE-2026-45740
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
High
CVE-2026-45793
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Medium
CVE-2026-56348
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
Medium
CVE-2026-56352
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
Medium
CVE-2026-45670
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
Medium
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
High
ghsa-xm96-gfjx-jcrc
ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation
High
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.