Medium
CVE-2026-39381
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-35583
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
High
CVE-2026-35581
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
Critical
CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
High
CVE-2026-39371
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
High
CVE-2026-39370
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
High
CVE-2026-39369
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
Medium
CVE-2026-39368
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
Medium
CVE-2026-39367
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
Medium
CVE-2026-39366
WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php
Medium
ghsa-5g3j-89fr-r2vp
skilleton has improper input handling in repository/path processing
Medium
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Low
CVE-2026-5751
justhtml: Mutation XSS with custom foreign-namespace sanitization policies
Medium
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
High
ghsa-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
High
CVE-2026-39555
Askka - Candle Shop WordPress Theme <= 1.3.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-45215
EasyPay <= 4.3.0 - Unauthenticated Information Exposure
Medium
CVE-2026-2519
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
Critical
CVE-2026-39587
WP BASE Booking of Appointments, Services and Events <= 5.9.0 - Unauthenticated Privilege Escalation
High
CVE-2026-39522
Solene <= 3.4 - Unauthenticated Local File Inclusion
Critical
d7261e93-2341-4e14-a9b3-8fec295f6cde
Smart Slider 3 Pro 3.5.1.35 - Backdoor Embedded via Supply Chain Compromise
High
CVE-2026-39550
Aperitif <= 1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-39523
Solene Core <= 2.3.2 - Unauthenticated Local File Inclusion
High
CVE-2026-39559
Uppercase < 1.2.2 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.