Medium
CVE-2026-48968
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-7651
User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter
Medium
CVE-2026-48973
SVG Support <= 2.5.14 - Missing Authorization
High
CVE-2026-44177
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Medium
CVE-2026-44176
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
High
CVE-2026-44175
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
High
CVE-2026-44174
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
High
CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
High
CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
High
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Medium
CVE-2026-42568
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
High
CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
High
CVE-2026-42089
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
Medium
CVE-2026-41207
netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
Medium
CVE-2026-44899
Mistune Image Directive CSS Injection Vulnerability
Medium
CVE-2026-44898
Mistune TOC Anchor Injection XSS
Medium
CVE-2026-44897
Mistune Heading ID Attribute has Injection XSS
Medium
CVE-2026-44896
Mistune has XSS via unescaped figclass/figwidth in Figure directive
Medium
CVE-2026-44708
Mistune Math Plugin has an XSS Escape Bypass
Medium
CVE-2025-0898
Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG
Medium
CVE-2026-3348
MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-3349
MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter
Medium
CVE-2026-2288
myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter
Medium
CVE-2026-2280
rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.