Medium
CVE-2026-6222
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-43975
Apache Wicket has a Path Traversal issue
High
CVE-2026-43646
Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Critical
CVE-2026-40010
Apache Wicket has a Session Fixation issue
Medium
CVE-2026-42509
Apache Wicket has a Cross-site Scripting issue
High
CVE-2026-7448
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42653
Affiliate Program Suite — SliceWP Affiliates <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-44221
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
High
CVE-2026-43885
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
Low
ghsa-7ww3-xvf5-cxwm
ciguard: Web UI is missing HTTP defence-in-depth headers
Medium
CVE-2026-44217
sse-channel: SSE Injection via unsanitized event fields
High
CVE-2026-43884
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
Medium
CVE-2026-43883
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
High
CVE-2026-40110
Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`
High
CVE-2026-40934
Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart
High
ghsa-mggx-p7jf-jgw4
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
Medium
CVE-2026-43882
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
Medium
CVE-2026-43881
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
Medium
CVE-2026-42348
OpAMP client reads unbounded HTTP response bodies
Medium
CVE-2026-43880
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Medium
CVE-2026-42338
ip-address has XSS in Address6 HTML-emitting methods
Medium
CVE-2026-43879
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
High
CVE-2026-42334
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
High
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.