High
CVE-2026-44635
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,547
Critical
CVE-2026-43898
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
High
CVE-2026-42071
MantisBT has a Private Bugnote Attachment Content Leak via REST API
Medium
CVE-2026-42070
MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
Medium
CVE-2026-41897
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
Medium
CVE-2026-41159
Mermaid: Improper sanitization of configuration leads to CSS injection
Medium
CVE-2026-41150
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Medium
CVE-2026-41149
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Medium
CVE-2026-41148
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
High
CVE-2026-40607
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
Medium
CVE-2026-40598
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
High
CVE-2026-40597
MantisBT has a Content Security Policy bypass via attachments
High
CVE-2026-40596
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
Medium
CVE-2026-39960
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
High
CVE-2026-39850
Yii 2: Local file inclusion via view parameter name collision
Medium
CVE-2026-34970
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
Medium
CVE-2026-34754
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
Medium
CVE-2026-34744
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
Medium
CVE-2026-34579
MantisBT has an authorization bypass in private issue monitoring
High
CVE-2026-34463
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
Medium
CVE-2026-34390
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator
Medium
CVE-2026-3604
WP SEO Structured Data Schema <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameter
Medium
CVE-2026-2300
BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block
Medium
CVE-2026-4301
Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.