Medium
CVE-2026-18777
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-77115
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content < 0.8.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-55451
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
Critical
CVE-2026-77264
Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
Medium
ghsa-jm5p-837g-rv8g
Wagtail: Improper restriction handling on Page translation API endpoint
Medium
ghsa-x5cx-w6p2-mxf2
Wagtail: Improper permission handling when copying snippets
Medium
ghsa-c2xx-cjmh-9q8f
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Low
ghsa-92hv-j533-69wc
Wagtail: Identification of documents by SHA1 hash
Medium
ghsa-hq84-x37p-j6q5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Medium
ghsa-p2ch-c2c3-4xm5
Winter: CSRF through AJAX handler names reachable as backend page actions
Medium
ghsa-5cwr-5jxg-pcf6
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
High
ghsa-fm29-4mq3-phg6
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Medium
ghsa-mpmw-f6h6-3g26
Winter: My Account preview exposes another backend user's profile by record ID
Low
ghsa-7mpf-4465-7fc2
Winter: Stored XSS through Backend List widget image columns
High
CVE-2026-79774
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Medium
CVE-2026-79773
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
High
CVE-2026-63202
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
Medium
CVE-2026-63179
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
High
CVE-2026-61827
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
High
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Medium
CVE-2026-61799
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
High
CVE-2026-61798
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Medium
CVE-2026-57570
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
High
ghsa-ghvf-qf6h-g8x5
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.