Medium
CVE-2026-7563
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,540
High
CVE-2026-6228
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
High
CVE-2026-6403
Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
Critical
CVE-2026-5229
Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback
Medium
CVE-2026-8425
Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
High
CVE-2026-45011
Apostrophe has stored XSS via javascript: URL in Image Widget Link
High
CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
High
CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Critical
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
High
ghsa-7rx4-c5vx-g8w3
Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections
High
CVE-2026-44513
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
Medium
ghsa-9m65-766c-r333
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function
Medium
CVE-2026-45292
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
High
CVE-2026-46480
FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
High
CVE-2026-46479
FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
High
CVE-2026-46478
FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
High
CVE-2026-46477
FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
High
CVE-2026-46476
FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
High
CVE-2026-46475
FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
High
CVE-2026-46444
FlowiseAI: Vector Store No Permission Checks
High
CVE-2026-45732
n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
High
CVE-2026-44792
n8n Has a Source Control Pull SQL Injection
Critical
CVE-2026-44791
n8n Has an XML Node Prototype Pollution Patch Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.