High
CVE-2026-45300
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Medium
CVE-2026-47741
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
High
CVE-2026-47740
shopper/framework: Authorization bypass in multiple Livewire admin components
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max` DoS protection
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Medium
ghsa-5r97-79vw-qvm4
Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds
Medium
ghsa-c55g-rp4x-fx84
Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds
High
ghsa-j5rm-v3vh-vx94
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
ghsa-qq2p-4282-cfc5
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
Medium
ghsa-74r7-3mjm-jc5v
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Medium
CVE-2026-45660
Statamic CMS: Server-Side Request Forgery via Glide
Medium
CVE-2026-42326
ImageMagick: Heap Buffer Over-Read in IPTC encoder
Medium
CVE-2026-45577
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Low
ghsa-97r8-rf7q-wmjw
Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML
Medium
CVE-2026-6402
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
Medium
CVE-2026-45620
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`
High
CVE-2026-45609
Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
High
CVE-2026-46510
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
High
ghsa-qw48-84f6-28gv
Graphite Has a Pickle Deserialization Vulnerability
Medium
CVE-2026-45582
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Critical
CVE-2026-7301
SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
Critical
CVE-2026-7302
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.