Low
CVE-2026-52839
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Low
CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
High
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Medium
ghsa-wchh-9x6h-7f6p
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
High
CVE-2026-11393
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
High
CVE-2026-50559
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Low
ghsa-pc2w-4mq8-32qw
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
Critical
CVE-2026-16610
Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
High
CVE-2026-67213
nanoid: custom generators can loop indefinitely when size is zero
High
CVE-2026-67214
nanoid: non-secure generators can loop indefinitely with negative size
Medium
CVE-2026-54081
veraPDF Parser DoS via PostScript Type 1 Font Programs
Medium
CVE-2026-54080
veraPDF Parser DoS via PostScript CMap Streams
High
CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
Medium
CVE-2026-54082
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
High
CVE-2026-54078
veraPDF Validation XXE via Rich Text
High
CVE-2026-14356
FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
High
CVE-2026-54079
veraPDF Validation XXE via XFA
Medium
CVE-2026-16092
Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
High
CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
High
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
High
CVE-2026-54661
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.