Medium
CVE-2025-9988
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,547
Medium
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Medium
CVE-2025-9987
Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure
Medium
CVE-2025-9989
Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-7051
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
Medium
CVE-2025-14755
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
Critical
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
High
CVE-2026-44295
protobuf.js: Code injection in pbjs static output from crafted schema names
Medium
CVE-2026-44294
protobuf.js: Denial of service from crafted field names in generated code
High
CVE-2026-44293
protobuf.js: Code injection through bytes field defaults in generated toObject code
Medium
CVE-2026-44292
protobuf.js: Prototype injection in generated message constructors
High
CVE-2026-44291
protobuf.js: Code generation gadget after prototype pollution
High
CVE-2026-44290
protobuf.js: Process-wide denial of service through unsafe option paths
High
CVE-2026-44289
protobuf.js: Denial of service through unbounded protobuf recursion
Medium
CVE-2026-44288
protobufjs has overlong UTF-8 decoding
High
CVE-2026-42290
protobuf.js is Vulnerable to OS Command Injection in the CLI
High
CVE-2026-41712
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
High
CVE-2026-41713
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
High
CVE-2026-1250
Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
Medium
CVE-2025-15463
Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-5371
MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-6177
Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
Medium
CVE-2026-6828
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.