High
CVE-2026-33661
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,591
High
CVE-2026-27602
Modoboa has OS Command Injection
High
CVE-2025-67030
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Medium
CVE-2026-30587
Seafile Server has multiple stored XSS vulnerabilities
Critical
CVE-2026-26831
textract is vulnerable to OS Command Injection
Critical
CVE-2026-26833
thumbler allows OS Command Injection
Critical
CVE-2026-26832
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
High
CVE-2026-33651
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
High
CVE-2026-33650
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
High
CVE-2026-33649
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
High
CVE-2026-33648
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
High
CVE-2026-33647
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Low
ghsa-8g29-8xwr-qmhr
@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling
Low
ghsa-5j35-xr4g-vwf4
@grackle-ai/server has a Missing Secure Flag on Session Cookie
Medium
ghsa-3mjm-x6gw-2x42
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
Medium
ghsa-xq7h-vwjp-5vrh
@grackle-ai/powerline Runs Without Authentication by Default
High
ghsa-w3hv-x4fp-6h6j
@grackle-ai/server has Missing WebSocket Origin Header Validation
Medium
CVE-2026-1206
Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
High
ghsa-647h-p824-99w7
@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool
Medium
CVE-2026-25645
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
Low
ghsa-7q9x-8g6p-3x75
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
High
CVE-2026-27496
n8n has In-Process Memory Disclosure in its Task Runner
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.