High
CVE-2026-34731
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-34716
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
Medium
CVE-2026-34613
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
Medium
ghsa-5qvp-pr9f-2g2v
poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645
Medium
CVE-2026-34611
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
Medium
ghsa-qc22-xmq4-qg46
c2cciutils affected by CVE-2022-40896
High
CVE-2026-34236
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
High
CVE-2026-29782
OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
High
CVE-2026-28805
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
Medium
CVE-2026-0688
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-0686
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
Unrated
CVE-2026-35000
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPat
High
CVE-2026-5032
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
Medium
CVE-2026-2265
Replicator deserializes untrusted user input
Medium
CVE-2026-34446
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
High
CVE-2026-34445
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
Medium
CVE-2026-34447
ONNX: External Data Symlink Traversal
High
CVE-2026-27489
onnx Vulnerable to Path Traversal via Symlink
High
CVE-2026-4347
MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
Unrated
CVE-2026-5343
drupal/miniorange_saml - SA-CONTRIB-2026-031
Critical
CVE-2026-34751
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
High
CVE-2026-34604
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
Medium
CVE-2026-104473
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities
High
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.