Mittel
CVE-2026-32546
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.602
Mittel
CVE-2026-3577
Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title
Mittel
CVE-2026-32441
Comments Import & Export <= 2.4.9 - Missing Authorization
Hoch
CVE-2026-32536
Green Downloads <= 2.08 - Authenticated (Subscriber+) Arbitrary File Upload
Hoch
CVE-2026-32494
Image Slider by Ays- Responsive Slider and Carousel <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting
Kritisch
CVE-2026-32520
RewardsWP – Loyalty Points & Referral Program for WooCommerce <= 1.0.4 - Unauthenticated Privilege Escalation
Niedrig
CVE-2026-3339
Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
Hoch
CVE-2026-33409
Parse Server has an auth provider validation bypass on login via partial authData
Mittel
ghsa-5rpf-x9jg-8j5p
Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)
Hoch
CVE-2026-74794
Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)
Hoch
CVE-2026-74795
Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)
Mittel
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Hoch
CVE-2026-27953
ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
Mittel
CVE-2026-2421
ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter
Mittel
CVE-2026-2432
CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels
Mittel
CVE-2026-3550
RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions
Hoch
CVE-2026-4267
Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
Hoch
CVE-2026-33354
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
Kritisch
CVE-2026-33352
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
Kritisch
CVE-2026-33351
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
Mittel
CVE-2026-33349
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Mittel
CVE-2026-33347
league/commonmark has an embed extension allowed_domains bypass
Mittel
CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
Mittel
CVE-2026-33323
Parse Server email verification resend page leaks user existence
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.