Medium
CVE-2026-39859
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Medium
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Low
CVE-2026-34166
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
High
CVE-2026-33229
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
Medium
CVE-2026-5742
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
Critical
CVE-2026-1830
Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
Medium
CVE-2026-4336
Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
Medium
CVE-2026-5357
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-5711
Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute
High
CVE-2026-5436
MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
Medium
CVE-2026-0811
Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
Medium
CVE-2026-0814
Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export
Critical
CVE-2026-2942
ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess
Medium
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Medium
CVE-2026-39409
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Medium
CVE-2026-56762
Hono missing validation of cookie name on write path in setCookie()
Medium
CVE-2026-39408
Hono: Path traversal in toSSG() allows writing files outside the output directory
Medium
CVE-2026-39407
Hono: Middleware bypass via repeated slashes in serveStatic
Medium
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Medium
CVE-2026-39398
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools
Critical
CVE-2026-39397
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
High
CVE-2026-39356
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.