Medium
ghsa-6rmx-gvvg-vh6j
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
ghsa-rchv-x836-w7xp
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
Medium
CVE-2026-30927
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Critical
CVE-2026-30863
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Medium
CVE-2026-30854
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Medium
CVE-2026-30850
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
Medium
CVE-2026-30848
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
High
CVE-2026-30920
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
High
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
Critical
CVE-2026-0953
Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
Medium
CVE-2025-70050
An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.
High
CVE-2026-3585
The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
Medium
CVE-2026-1919
Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
Medium
CVE-2026-1920
Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
Critical
CVE-2026-24015
Apache IoTDB has an Insecure Default Configuration Vulnerability
Critical
CVE-2026-24713
Apache IoTDB has an Improper Input Validation vulnerability
Medium
CVE-2026-22520
Handmade Framework <= 3.9 - Reflected Cross-Site Scripting
High
CVE-2026-22507
Beelove | Honey Production and Sweets Online Store WordPress Theme <= 1.2.6 - Unauthenticated PHP Object Injection
High
CVE-2026-22510
Melody <= 1.6.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-32449
Themify Event Post <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32447
Atarim <= 4.3.2 - Missing Authorization
Medium
CVE-2026-32448
Podlove Podcast Publisher <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-29780
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
High
CVE-2026-29778
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.