Critical
CVE-2026-35002
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-4325
Keycloak: Replay of action tokens via improper handling of single-use entries
High
CVE-2026-4282
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
High
CVE-2026-4634
Keycloak: Application-Level DoS via Scope Processing
High
CVE-2026-4636
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
High
CVE-2026-3872
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
High
CVE-2026-33641
Glances Vulnerable to Command Injection via Dynamic Configuration Values
High
CVE-2026-33533
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Low
CVE-2026-5327
fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function
Low
CVE-2026-5323
a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function
High
CVE-2026-2696
Export All URLs < 5.1 - Unauthenticated Information Exposure
Medium
CVE-2026-5451
Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode
Medium
CVE-2026-34890
MSTW League Manager <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-15484
Order Notification for WooCommerce – Get Audio Alert on new Orders < 3.6.3 - Unauthenticated Remote Code Execution
High
ghsa-w2fm-25vw-vh7f
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')
High
ghsa-32wq-ppwg-3w4m
EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory
High
CVE-2026-34825
NocoBase Has SQL Injection via template variable substitution in workflow SQL node
Medium
CVE-2026-34974
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
Medium
CVE-2026-34973
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Critical
CVE-2026-34953
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Critical
CVE-2026-34952
PraisonAI Has Missing Authentication in WebSocket Gateway
Medium
CVE-2026-56347
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
Critical
CVE-2026-34934
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Critical
CVE-2026-34935
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.