High
CVE-2026-7330
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,583
High
CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-42879
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
Medium
CVE-2026-42878
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
Medium
CVE-2026-42877
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
Low
CVE-2026-27964
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Medium
CVE-2026-27892
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
High
CVE-2026-27891
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
High
CVE-2026-8086
A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads
Medium
CVE-2026-8084
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This
High
CVE-2026-44244
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
High
CVE-2026-44243
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
High
CVE-2026-42215
GitPython has Command Injection via Git options bypass
High
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transformation
Critical
CVE-2025-63704
query-parser-string is vulnerable to Prototype Pollution
Medium
CVE-2026-36341
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
Critical
CVE-2025-63703
parse-ini is vulnerable to Prototype Pollution in index.js()
High
CVE-2025-65122
youtube-regex vulnerable to Regex Denial of Service
Critical
ghsa-54pg-9963-v8vg
Compromised version of intercom-client published to npm
Critical
ghsa-gr3r-crp5-qrrm
Compromised tag of intercom-php published via GitHub
High
CVE-2026-42553
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
High
CVE-2025-63705
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
Critical
CVE-2025-63706
next-npm-version is vulnerable to Command injection
Medium
CVE-2026-44263
Weblate Vulnerable to Private Translation Enumeration via Screenshot API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.