Medium
CVE-2026-4512
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-4106
HT Mega Addons for Elementor – Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure
Medium
CVE-2026-40793
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization
Medium
CVE-2026-40794
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.3 - Missing Authorization
Low
CVE-2026-41321
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
High
CVE-2026-41900
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
Medium
CVE-2026-41173
OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads
Medium
CVE-2026-40894
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
Medium
CVE-2026-40891
OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling
Medium
CVE-2026-40182
OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
Medium
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
High
CVE-2026-39973
Apktool: Path Traversal to Arbitrary File Write
High
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
High
CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
Medium
CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
Critical
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
Medium
CVE-2026-4078
ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-11762
HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
Medium
CVE-2026-3569
Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint
High
CVE-2026-41241
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
High
CVE-2026-41205
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Medium
CVE-2026-3565
Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
Medium
CVE-2026-5347
WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter
High
CVE-2026-5364
Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.