Medium
CVE-2026-59875
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-59725
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
High
CVE-2026-13311
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
High
CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
High
CVE-2026-61835
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Medium
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
Medium
CVE-2026-59868
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
High
CVE-2026-59869
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Medium
CVE-2026-59870
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
Medium
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
High
CVE-2026-53515
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
High
CVE-2026-13149
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Medium
CVE-2026-15145
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
Medium
CVE-2026-1372
Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
High
CVE-2026-1771
MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
High
CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious transitive package name
Medium
CVE-2026-67313
Axios: Excessive recursion in formDataToJSON can cause denial of service
Medium
CVE-2026-67314
Axios: Prototype pollution auth subfields can inject Basic auth
Medium
CVE-2026-67312
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Critical
CVE-2026-13439
Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
Medium
CVE-2026-15782
WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
Medium
CVE-2026-15156
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
Medium
CVE-2026-12900
Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block
Medium
CVE-2026-14841
King Addons for Elementor <= 51.1.75 - Reflected XSS via Posts Grid Widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.