High
CVE-2025-71370
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2025-71351
Picklescan missing detection when calling built-in python library function timeit.timeit()
High
CVE-2025-71376
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
High
CVE-2025-71341
Picklescan has a missing detection when calling built-in python profile.Profile.runctx
High
CVE-2026-15897
Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
High
CVE-2026-92174
SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
Critical
CVE-2026-15896
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Critical
CVE-2026-19660
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
Critical
CVE-2026-19652
Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter
High
CVE-2026-10026
CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2026-92952
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Critical
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
High
CVE-2026-92950
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Critical
CVE-2026-92940
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Critical
CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
High
CVE-2026-92958
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
Critical
CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
Medium
CVE-2026-92949
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
Critical
CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Critical
CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Critical
CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
Critical
CVE-2026-92939
vm2 crypto builtin loads attacker native code through setEngine
Critical
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Critical
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.