Low
CVE-2026-107727
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 307
Reset filters
High
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Medium
CVE-2026-46437
wger: API credentials remain valid after logout/password change
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Medium
CVE-2026-57179
social-auth-core has a Session Fixation issue
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Medium
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Critical
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
Medium
CVE-2026-61588
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
High
ghsa-62mm-xwmv-crhg
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
High
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
High
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Medium
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Medium
CVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Medium
CVE-2026-54625
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
High
CVE-2026-54623
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Medium
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Medium
CVE-2026-61663
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Medium
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission
Medium
CVE-2026-63003
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Medium
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception rendering
Medium
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
High
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.