High
CVE-2026-40909
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
Medium
CVE-2026-40907
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
Critical
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
Medium
CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unavailability
Medium
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in page history compare
High
CVE-2026-39971
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
Medium
CVE-2026-39963
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
High
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Critical
CVE-2026-39842
Expression Injection in OpenRemote
Medium
CVE-2026-25133
October Rain has Stored XSS via SVG Filter Bypass
Medium
CVE-2026-25125
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
Low
CVE-2026-7808
Multiple security fixes in justhtml
High
CVE-2026-40176
Composer has a command injection via malicious perforce repository
Medium
CVE-2026-24907
October CMS has Stored XSS in Event Log Mail Preview
Medium
CVE-2026-24906
October CMS has Stored XSS in Backend Editor Markup Classes
Medium
CVE-2026-22692
October Rain has a Twig Sandbox Bypass via Collection Methods
High
CVE-2026-40261
Composer has a command injection via malicious perforce reference
Medium
CVE-2026-40255
@adonisjs/http-server has an Open Redirect vulnerability
Medium
CVE-2026-1782
MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'
Critical
CVE-2026-3461
Visa Acceptance Solutions <= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email
High
CVE-2026-3643
Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API
Medium
CVE-2026-4005
Coachific Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute
Medium
CVE-2026-3659
WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.