High
CVE-2026-59932
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,436
High
CVE-2026-59931
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Critical
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
High
CVE-2026-73418
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Critical
CVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Medium
CVE-2026-73419
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Medium
CVE-2026-15100
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Medium
CVE-2026-11354
Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Medium
CVE-2025-9205
MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-13464
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Medium
CVE-2026-6454
Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
High
CVE-2026-12736
WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Medium
CVE-2026-15420
Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
High
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
High
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Medium
CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Low
CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
High
Exploited in attacks
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Low
CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Medium
CVE-2026-54559
PocketSphinx: Buffer overflows in language and acoustic model loading code
High
CVE-2026-54549
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.