High
CVE-2026-55501
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,504
Critical
CVE-2026-55500
9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover
High
CVE-2026-55794
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Medium
CVE-2026-59711
showdown metadata title handling allows cross-site scripting
Medium
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
High
CVE-2026-55790
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Critical
CVE-2026-59801
9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats
High
CVE-2026-57573
Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)
Critical
CVE-2026-57572
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
High
CVE-2026-55574
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
High
CVE-2026-55514
vLLM denial of service via prompt embeds on M-RoPE models
Critical
CVE-2026-57571
Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE
High
CVE-2026-54640
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
High
CVE-2026-54641
OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
Medium
CVE-2026-56384
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
Critical
CVE-2026-53486
Decompress: Archive extraction can create files and links outside of the target directory
Medium
CVE-2026-55646
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
High
CVE-2026-54059
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Medium
CVE-2026-55798
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
High
CVE-2026-55379
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
High
CVE-2026-55380
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
High
CVE-2026-73061
Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.