Medium
CVE-2026-10530
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Medium
CVE-2026-4610
ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
Medium
CVE-2026-52701
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization
Medium
CVE-2026-12397
Job Portal <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Disclosure
Medium
CVE-2025-71378
Picklescan is missing detection when calling built-in Python cProfile.runctx
High
CVE-2025-71357
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
High
CVE-2025-71348
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
High
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
Medium
CVE-2026-56304
picklescan vulnerable to arbitrary file create using logging.FileHandler
Medium
CVE-2026-58203
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
High
CVE-2026-58201
Lokka: Azure Resource Manager URL path validation issue
High
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
High
CVE-2026-59152
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Medium
CVE-2026-58266
Anki: User scripts in iframes have access to the internal Anki API
Medium
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
Critical
CVE-2026-56120
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
High
ghsa-v3f4-w7r7-v3hm
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
High
CVE-2026-76238
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
High
CVE-2026-76237
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
High
CVE-2026-76236
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
Low
CVE-2026-57481
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.