Medium
CVE-2026-45581
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-7613
Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import
Critical
CVE-2026-2586
GlassFish's Administration Console is Vulnerable to RCE
Critical
CVE-2026-2587
GlassFish's gadget handler is vulnerable to RCE
Critical
CVE-2026-47323
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
Critical
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Medium
CVE-2026-5075
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
High
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
High
CVE-2026-46396
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
Critical
CVE-2026-46395
HAXcms: Private Key Disclosure via Broken HMAC Implementation
High
CVE-2026-46391
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
Medium
CVE-2026-46496
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
High
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
High
CVE-2026-74784
Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString
Critical
ghsa-27f5-xjrr-q9ff
Malware in @opensearch-project/opensearch
High
CVE-2026-9010
Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters
Critical
CVE-2026-7637
Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
Medium
CVE-2025-15369
Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
Critical
CVE-2026-7284
Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register
High
CVE-2026-7504
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
High
CVE-2026-7507
Keycloak: Session fixation in OIDC login flow that can lead to account takeover
High
CVE-2026-7571
Keycloak: Access token disclosure and implicit flow bypass via forged client data
Low
CVE-2026-7860
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability
Medium
CVE-2026-4630
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.