High
CVE-2026-45578
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
High
CVE-2026-45575
Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client
High
CVE-2026-35194
Apache Flink: Remote code execution via SQL injection in code generation
Medium
CVE-2026-23695
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
High
CVE-2026-45574
epa4all-client: TLS Certificate Validation Disabled in Production
High
CVE-2026-56345
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
High
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
High
CVE-2026-44692
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
High
CVE-2026-45715
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
High
CVE-2026-45364
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Medium
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
High
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
High
CVE-2026-22810
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
Medium
CVE-2025-65954
SimpleSAMLphp casserver: Open Redirect in logout
High
CVE-2026-38728
smtp-server's command parser memory exhaustion denial-of-service
Medium
CVE-2026-8681
Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter
High
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Medium
CVE-2026-42677
WP Document Revisions <= 3.8.1 - Missing Authorization
High
CVE-2021-47965
WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-42676
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42675
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
Medium
CVE-2026-45438
Smart Coupons For WooCommerce Coupons < 2.3.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.