Low
CVE-2026-44242
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Critical
CVE-2026-44262
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
High
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
High
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Medium
CVE-2026-80198
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
Medium
CVE-2026-80202
Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation
High
CVE-2026-44232
dssrf: every IPv6 category bypasses is_url_safe
High
CVE-2024-27354
phpseclib: guardrails needed on isPrime and randomPrime
High
CVE-2026-44012
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
High
CVE-2026-44011
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
High
CVE-2026-44010
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Medium
ghsa-4c35-wcg5-mm9h
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
CVE-2026-42280
Auth.js SDK has Improper Permission Checking
Critical
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Critical
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
High
CVE-2026-6692
Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url
High
CVE-2026-7252
WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
Medium
CVE-2026-8026
Flowise: Bcrypt Password Hash Exposure
High
CVE-2026-4348
BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
Medium
CVE-2026-6214
Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
Medium
CVE-2026-4807
Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.