High
CVE-2026-33717
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,591
Critical
CVE-2026-33716
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
Critical
CVE-2026-33701
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
Medium
CVE-2026-33672
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
High
CVE-2026-33671
Picomatch has a ReDoS vulnerability via extglob quantifiers
High
CVE-2026-33665
n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
High
CVE-2026-33663
n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
Critical
CVE-2026-33660
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
Medium
ghsa-v3rj-xjv7-4jmq
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines
High
CVE-2026-6409
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
CVE-2026-33548
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline
Medium
CVE-2026-33532
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
High
CVE-2026-33686
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
High
CVE-2026-33687
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
High
CVE-2026-33517
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
Medium
CVE-2026-33690
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
Medium
ghsa-wxjx-r2j2-96fx
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
Medium
CVE-2026-33688
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
Medium
CVE-2026-33685
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
Medium
CVE-2026-33683
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
High
CVE-2026-33681
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
High
CVE-2026-33673
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
Low
CVE-2026-33674
PrestaShop: Improper Use of Validation Framework
Medium
CVE-2026-3635
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.