Medium
ghsa-qrfh-cc86-vc8c
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-25048
xgrammar vulnerable to DoS via multi-layer nesting
Medium
CVE-2025-69534
Python-Markdown has an Uncaught Exception
Medium
CVE-2026-2589
Greenshift – animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup
Medium
CVE-2026-2593
Greenshift – animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to a
High
CVE-2026-3459
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload
High
CVE-2026-29093
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-29784
Ghost has incomplete CSRF protections around OTC use
High
CVE-2026-29182
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
Critical
CVE-2026-29000
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
High
CVE-2026-3520
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
Low
CVE-2026-29184
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
Low
CVE-2026-29185
Backstage vulnerable to potential reading of SCM URLs using built in token
High
CVE-2026-29186
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
Medium
CVE-2026-32443
Product Feed PRO for WooCommerce <= 13.5.2 - Cross-Site Request Forgery
Medium
CVE-2026-22480
WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More <= 2.3.3 - Authenticated (Shop manager+) PHP Object Injection
High
CVE-2026-22509
Gioia <= 1.4 - Unauthenticated Local File Inclusion
High
CVE-2026-22505
Morning Records - Music Sound Studio WordPress Theme <= 1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-22503
Nelson <= 1.2.0 - Unauthenticated Local File Inclusion
High
CVE-2026-22499
Lella <= 1.2 - Unauthenticated Local File Inclusion
High
CVE-2026-22498
Laurent - Elegant Restaurant WordPress Theme <= 3.1 - Unauthenticated Local File Inclusion
High
CVE-2026-22484
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.5.0 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.