Medium
CVE-2026-25493
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,597
Medium
CVE-2026-25492
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Low
CVE-2026-25491
Craft CMS Vulnerable to Stored XSS in Entry Types Name
Medium
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
Medium
CVE-2026-25480
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Medium
CVE-2026-25479
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
High
CVE-2026-25478
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Medium
CVE-2026-1722
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
High
CVE-2026-25639
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Medium
CVE-2026-0996
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
Medium
CVE-2026-23903
Apache Shiro has an Authentication Bypass
High
CVE-2026-0845
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
Medium
CVE-2025-15147
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment
Medium
CVE-2026-24098
Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
Medium
CVE-2026-22922
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
High
CVE-2026-1615
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
High
CVE-2025-67995
PatioTime < 2.1 - Unauthenticated PHP Object Injection
High
CVE-2025-69387
Simple Retail Menus <= 4.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-32338
Construction Landing Page <= 1.4.1 - Missing Authorization
Medium
CVE-2025-69386
RVCFDI para Woocommerce <= 8.1.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-32336
Rara Business <= 1.3.0 - Missing Authorization
Critical
CVE-2025-69379
Upload Files Anywhere <= 2.8 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-69325
Primer MyData for Woocommerce <= 4.2.8 - Unauthenticated Path Traversal
High
CVE-2025-67992
PatioTime < 2.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.