Medium
CVE-2026-3998
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-4091
OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery
Medium
CVE-2026-4002
Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action
Medium
CVE-2026-3649
Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action
Medium
CVE-2026-3642
e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX
Medium
CVE-2026-4011
Power Charts <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Medium
CVE-2026-5717
VI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute
High
CVE-2026-5617
Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
High
CVE-2026-5694
Quick Interest Slider <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40312
ImageMagick has an off-by-one error in MSL decoder could result in crash
Medium
CVE-2026-40311
ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.
Medium
CVE-2026-40310
ImageMagick has a heap out-of-bounds write in JP2 encoder
Medium
CVE-2026-40183
ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float
Medium
CVE-2026-40169
ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.
Medium
CVE-2026-33905
ImageMagick has an out-of-bounds read in sample operation
Medium
CVE-2026-33902
ImageMagick has a Stack Overflow via Recursive FX Expression Parsing
High
CVE-2026-38530
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
High
CVE-2026-38529
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
High
CVE-2026-38532
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
High
CVE-2026-38527
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
Medium
CVE-2026-6293
Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter
Medium
CVE-2026-37980
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Critical
CVE-2025-61260
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
Critical
CVE-2026-1555
WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.