Low
CVE-2026-37977
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Low
CVE-2026-5602
@nor2/heim-mcp vulnerable to command injection
Low
CVE-2026-5603
@elgentos/magento2-dev-mcp vulnerable to command injection
Medium
CVE-2025-14944
Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
Medium
CVE-2026-34888
Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure
Medium
CVE-2026-34891
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
Medium
CVE-2026-34897
Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-34885
Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2016-20054
Nodcms contains a cross-site request forgery vulnerability
Critical
CVE-2026-35459
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
High
CVE-2026-34511
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
High
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
Medium
CVE-2026-35452
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
Medium
CVE-2026-35450
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
Medium
CVE-2026-35449
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
Low
CVE-2026-35448
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Medium
CVE-2026-35441
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Medium
CVE-2026-39943
Directus: Sensitive fields exposed in revision history
High
CVE-2026-35412
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35413
Directus: GraphQL Schema SDL Disclosure Setting
Medium
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.