High
CVE-2025-56015
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-4025
PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
Medium
CVE-2026-4300
Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting
Medium
CVE-2026-4073
pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
Medium
CVE-2026-4303
WP Visitor Statistics (Real Time Traffic) <= 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
Medium
CVE-2026-35571
Emissary has Stored XSS via Navigation Template Link Injection
Medium
CVE-2026-39373
JWCrypto: JWE ZIP decompression bomb
High
CVE-2026-39376
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
High
CVE-2026-35568
Java-SDK has a DNS Rebinding Vulnerability
Medium
CVE-2026-1396
Magic Conversation For Gravity Forms <= 3.0.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-4655
Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Medium
CVE-2026-4330
Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter
Medium
CVE-2026-27315
Apache Cassandra has sensitive Information Leak in cqlsh
Low
CVE-2026-32588
Apache Cassandra has an authenticated DoS over CQL
High
CVE-2026-27314
Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator
Medium
CVE-2025-70844
yaffa vulnerable to Cross Site Scripting
Medium
CVE-2026-40045
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
Medium
CVE-2026-41407
OpenClaw: Shared-secret comparison call sites leaked length information through timing
Medium
CVE-2026-41354
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
Medium
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Medium
CVE-2026-41360
OpenClaw: pnpm dlx approvals did not bind local script operands
Medium
CVE-2026-41339
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients
Medium
CVE-2026-41295
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup
Medium
CVE-2026-41298
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.