Low
CVE-2026-54282
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Low
CVE-2026-54275
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
Medium
CVE-2026-54273
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
Medium
CVE-2026-54274
aiohttp: Incomplete websocket frame payloads bypass memory limits
Low
CVE-2026-50269
aiohttp: CRLF injection in multipart headers
Medium
CVE-2026-33684
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
Critical
CVE-2025-58048
Paymenter vulnerable to Remote Code Execution via public file uploads
Medium
CVE-2026-44913
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Low
CVE-2026-44911
Apache NiFi allows read-only users to submit component configuration verification request
High
CVE-2026-44914
Apache NiFi: Missing authorization when replacing Process Groups with restricted components
Medium
CVE-2025-62198
Apache Atlas UI: Authenticated User XSS
Medium
CVE-2026-54665
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Medium
CVE-2026-12271
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
Medium
CVE-2026-11963
User Registration & Membership <= 5.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification
High
CVE-2026-6858
Transbank Webpay < 1.14.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11964
User Registration & Membership <= 5.2.1 - Unauthenticated PayPal Bypass to Membership Activation
Medium
CVE-2026-12274
Tutor LMS <= 3.9.12 - Authenticated (Instructor+) Insecure Direct Object Reference
Medium
CVE-2026-12273
Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation
High
CVE-2026-12582
Library Management System <= 3.5.7 - Unauthenticated SQL Injection
Medium
CVE-2026-12275
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure
High
CVE-2026-10551
Breeze Cache <= 2.5.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-12081
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-12396
Job Portal <= 2.5.4 - Missing Authorization
Medium
CVE-2026-7859
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.