Medium
CVE-2026-9013
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,563
Medium
CVE-2026-11989
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
Medium
CVE-2026-4328
Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
Medium
CVE-2026-12430
Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
Medium
CVE-2026-12157
BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
Medium
CVE-2026-10779
Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
High
CVE-2026-54005
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
Medium
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
High
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-49274
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
Medium
CVE-2026-53861
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-58653
praisonai-platform: Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
Medium
CVE-2026-57441
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
Medium
CVE-2026-57204
pypdf: Missing stream length values ignore defined limits
High
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Medium
CVE-2026-9678
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
High
CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
High
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Critical
CVE-2026-47103
python-statemachine SCXML <data expr> Eval Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.