Medium
CVE-2026-41173
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-40894
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
Medium
CVE-2026-40891
OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling
Medium
CVE-2026-40182
OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
Medium
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
High
CVE-2026-39973
Apktool: Path Traversal to Arbitrary File Write
High
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
High
CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
Medium
CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
Critical
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
Medium
CVE-2026-4078
ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-11762
HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
Medium
CVE-2026-3569
Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint
High
CVE-2026-41241
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
High
CVE-2026-41205
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Medium
CVE-2026-3565
Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
Medium
CVE-2026-5347
WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter
High
CVE-2026-5364
Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass
Medium
CVE-2026-5428
Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
Medium
CVE-2026-6810
Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
Critical
CVE-2026-40372
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
Medium
CVE-2026-5488
ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
Medium
CVE-2026-6393
BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
Medium
CVE-2026-2028
Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.