Medium
CVE-2026-74880
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-74877
openssl-encrypt has no owner verification on key revocation — any client can revoke any key
Critical
CVE-2026-74882
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private netw
Medium
CVE-2026-74871
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no
Unrated
CVE-2026-74870
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardw
Medium
CVE-2026-74874
openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
Medium
CVE-2026-74875
openssl-encrypt silently skips schema validation when jsonschema library is not installed
Medium
CVE-2026-74873
openssl-encrypt has visible password in process list via --password CLI argument
Medium
CVE-2026-74872
openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
High
CVE-2026-73360
Chaty Pro <= 3.5.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-73367
Easy Google Maps < 1.14.2 - Unauthenticated Arbitrary Remote Script Inclusion
Medium
CVE-2026-15253
Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-11565
Advanced File Manager <= 5.4.12 - Missing Authorization
Medium
CVE-2026-16570
NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected Cross-Site Scripting
High
CVE-2026-14334
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-13174
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
Medium
CVE-2026-13173
Eventin <= 4.1.20 - Missing Authorization
Medium
CVE-2026-32333
Mayosis Core <= 5.4.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-32467
[凹凸曼] 一键采集微信文章 <= 2.0.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-14825
Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference
High
CVE-2026-12983
Dinatur <= 1.18 - Unauthenticated SQL Injection
Medium
CVE-2026-28569
SSL Zen — SSL Certificate Installer & HTTPS Redirects <= 4.7.43 - Reflected Cross-Site Scripting
High
CVE-2026-32444
Cwicly <= 1.4.4 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-14196
WCFM Marketplace <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.