Medium
CVE-2026-35411
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-39942
Directus: Path Traversal and Broken Access Control in File Management API
High
CVE-2026-35408
Directus: Missing Cross-Origin Opener Policy
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
High
CVE-2026-106447
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
High
CVE-2026-106448
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
High
CVE-2026-35213
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
Low
CVE-2026-35200
Parse Server: File upload Content-Type override via extension mismatch
High
ghsa-2m67-wjpj-xhg9
Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers
Medium
CVE-2026-35181
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
Medium
CVE-2026-35179
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
High
CVE-2026-34824
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
High
CVE-2026-33175
Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
Medium
CVE-2026-0626
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
Medium
CVE-2026-3309
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
High
CVE-2026-3666
wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
High
CVE-2026-2936
Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-1233
Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
Medium
CVE-2025-14938
Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload
High
CVE-2026-35042
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
High
CVE-2026-35470
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.