High
CVE-2026-30940
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Critical
CVE-2026-30880
baserCMS has OS command injection vulnerability in installer
Medium
CVE-2026-30879
baserCMS has a cross-site scripting vulnerability in blog posts
Medium
CVE-2026-30878
baserCMS has Mail Form Acceptance Bypass via Public API
Critical
CVE-2026-30877
baserCMS Update Functionality Vulnerable to OS Command Injection
Medium
CVE-2026-27697
baserCMS has an SQL injection vulnerability in its blog post functionality
Critical
CVE-2026-21861
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
High
CVE-2025-32957
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Medium
CVE-2026-34452
Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
Medium
CVE-2026-34450
Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool
Low
CVE-2026-34203
Nautobot: Management of users via REST API does not apply configured password validators
Medium
CVE-2026-34231
Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag
Critical
CVE-2026-0596
Mlflow: Command Injection when serving models with enable_mlserver=True
Medium
CVE-2026-3831
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Medium
CVE-2026-4668
Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
Medium
CVE-2026-2480
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
Low
CVE-2026-34073
cryptography has incomplete DNS name constraint enforcement on peer names
High
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
High
CVE-2026-32727
SciTokens has an Authorization Bypass via Path Traversal in Scope Validation
High
CVE-2026-32716
SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking
Medium
CVE-2026-34886
Simple Membership <= 4.7.1 - Missing Authorization
Medium
CVE-2025-13535
King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2026-40764
Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery
Medium
CVE-2026-34887
Kubio AI Page Builder <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.