Medium
CVE-2025-56647
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-26063
CediPay Affected by Improper Input Validation in Payment Processing
Low
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
Critical
CVE-2026-26217
Crawl4AI Has Local File Inclusion in Docker API via file:// URLs
Critical
CVE-2026-26216
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
Medium
CVE-2026-26000
XWiki vulnerable to click-jacking through CSS injection in comments
Medium
CVE-2026-2327
markdown-it is has a Regular Expression Denial of Service (ReDoS)
High
CVE-2026-0969
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
High
CVE-2026-1320
Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
High
CVE-2026-1316
Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
Medium
CVE-2026-39629
Uminex <= 1.0.9 - Unauthenticated Arbitrary Shortcode Execution
Critical
CVE-2026-2418
Login with Salesforce <= 1.0.2 - Authentication Bypass
Medium
CVE-2026-25036
Passster <= 4.2.25 - Missing Authorization
Medium
CVE-2026-39627
Ashe <= 2.267 - Missing Authorization
Medium
CVE-2026-39575
Custom Query Blocks <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39628
DukaMarket <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-1671
Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
Medium
CVE-2026-1356
Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
High
CVE-2026-25990
Pillow affected by out-of-bounds write when loading PSD images
Medium
CVE-2025-69874
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
High
CVE-2026-25759
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
Unrated
CVE-2026-2349
drupal/ui_icons - SA-CONTRIB-2026-010
Medium
CVE-2026-25633
Statamic CMS's missing authorization allows access to assets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.