Medium
CVE-2026-45736
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Medium
CVE-2026-45731
AVideo: Authenticated Arbitrary File Read in view/update.php
High
CVE-2025-57282
ngrok is Vulnerable to Command Injection
Critical
CVE-2026-4885
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
Critical
CVE-2026-4883
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
Low
ghsa-jgg6-4rpr-wfh7
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Critical
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
Medium
CVE-2026-45031
ImageMagick: Policy Bypass in PSD decoder
Medium
CVE-2026-45358
ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
Medium
CVE-2026-45359
ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Medium
CVE-2026-45718
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
High
CVE-2026-45716
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
High
CVE-2026-45707
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
High
CVE-2026-8159
multiparty vulnerable to ReDoS via filename parsing
High
CVE-2026-8162
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
High
CVE-2026-8161
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
Low
ghsa-9m6v-8fxc-4r44
Sulu: Used API Keys may be available via Admin API
Medium
CVE-2026-45701
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
Critical
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
High
CVE-2026-45325
@tmlmobilidade/utils has prototype pollution in its setValueAtPath
Low
CVE-2026-2728
LibreNMS: Cross-Site Scripting in ShowConfigController
High
CVE-2026-42559
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.