Medium
CVE-2026-33883
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-33882
Statamic's Markdown preview endpoint exposes sensitive user data
High
CVE-2026-35660
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
Medium
CVE-2026-35634
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication
High
CVE-2026-35618
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
Critical
CVE-2026-33864
Convict has Prototype Pollution via startsWith() function
Critical
CVE-2026-33863
Convict has prototype pollution via load(), loadFile(), and schema initialization
High
CVE-2026-33871
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
High
CVE-2026-33870
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Low
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Medium
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
High
CVE-2026-32846
OpenClaw is vulnerable to Path Traversal through path validation bypass
Medium
CVE-2026-33751
n8n Vulnerable to LDAP Filter Injection in LDAP Node
Medium
CVE-2026-33750
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Medium
CVE-2026-33749
n8n Vulnerable to XSS via Binary Data Inline HTML Rendering
Critical
CVE-2026-33867
AVideo has Plaintext Video Password Storage
High
CVE-2026-33770
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
High
CVE-2026-33767
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
Medium
CVE-2026-33766
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
Medium
CVE-2026-33764
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
Medium
CVE-2026-33763
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
Medium
CVE-2026-33761
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
Medium
CVE-2026-33759
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
High
CVE-2026-6204
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.