Medium
CVE-2026-6236
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-5820
Zypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block
Medium
CVE-2026-6041
Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting
Medium
CVE-2026-6396
Fast & Fancy Filter – 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action
Medium
CVE-2026-5748
Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute
Medium
CVE-2026-6294
Google PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page
Medium
CVE-2026-5767
SlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute
Medium
CVE-2026-6246
Simple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute
Critical
CVE-2026-6235
Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests
High
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
High
CVE-2026-39861
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
Medium
CVE-2026-40606
mitmproxy has an LDAP Injection
Medium
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
High
CVE-2026-39320
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Low
CVE-2026-29179
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Low
CVE-2026-27937
October CMS: Reflected XSS via DataTable Form Widget
Medium
CVE-2026-26274
October CMS has Safe Mode Bypass via Twig Database Write Operations
Medium
CVE-2026-26067
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
High
CVE-2026-31018
Dolibarr Allows Code Injection through its Website Module
High
CVE-2026-31019
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
Medium
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Medium
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
High
CVE-2026-35570
OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal
Critical
CVE-2026-32613
Spinnaker: RCE via expression parsing due to unrestricted context handling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.