High
CVE-2026-66583
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,515
High
CVE-2026-66606
SmartSMTP <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66600
Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload
High
CVE-2026-66614
GEO Plugin by Squirrly SEO <= 14.2.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-73391
Total Donations <= 2.0.5 - Unauthenticated SQL Injection
High
CVE-2026-66581
JetEngine <= 3.8.14.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation
High
CVE-2026-84189
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Medium
CVE-2026-84188
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
Medium
CVE-2026-84190
LibreNMS Vulnerable to Remote Code Execution via AboutController
Critical
CVE-2026-62988
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Medium
CVE-2026-55593
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Medium
CVE-2026-54543
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
High
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
High
CVE-2026-55224
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Critical
CVE-2026-54133
jmespath.php has CompilerRuntime code injection via unescaped function names
High
ghsa-c7hr-448w-65px
MeshCentral has unsanitized data fields
Critical
CVE-2026-18963
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
High
CVE-2026-75981
TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-63640
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
High
CVE-2026-55178
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
High
CVE-2026-55182
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Medium
CVE-2026-15446
EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.