Medium
CVE-2026-55593
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,504
Medium
CVE-2026-54543
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
High
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
High
CVE-2026-55224
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Critical
CVE-2026-54133
jmespath.php has CompilerRuntime code injection via unescaped function names
High
ghsa-c7hr-448w-65px
MeshCentral has unsanitized data fields
Critical
CVE-2026-18963
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
High
CVE-2026-75981
TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-63640
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
High
CVE-2026-55178
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
High
CVE-2026-55182
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Medium
CVE-2026-15446
EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
High
CVE-2026-15780
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Medium
CVE-2026-63643
MagicMirror: ssrf calendar .js
Medium
CVE-2026-63642
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
Low
CVE-2026-63641
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
Low
CVE-2026-61634
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
Medium
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
High
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
High
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
High
CVE-2026-55839
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.