High
CVE-2026-43929
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2025-8267
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
High
CVE-2026-35397
Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories
High
CVE-2026-43897
link-preview-js vulnerable to IPv6 and internal loopback attacks
Medium
CVE-2026-42207
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
High
CVE-2026-42198
pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
Critical
CVE-2026-42196
django-s3file is vulnerable to relative path traversal
Medium
CVE-2026-42194
Admidio has an incomplete fix for CVE-2026-32812 (SSRF)
Low
CVE-2026-42188
Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
Critical
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Medium
CVE-2026-42140
XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter
Critical
CVE-2026-27960
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploit
Medium
CVE-2026-43878
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
Medium
CVE-2026-43877
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
Medium
CVE-2026-43876
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
Medium
CVE-2026-43875
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
High
CVE-2026-43874
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
High
CVE-2026-43873
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
High
CVE-2026-45006
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
High
CVE-2026-45004
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
Medium
CVE-2026-45005
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload
Medium
CVE-2026-42565
@workos/authkit-session has an Open Redirect via state-derived redirect target
High
CVE-2026-7332
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.