Medium
CVE-2026-4270
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-33039
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
Medium
CVE-2026-33035
Unauthenticated Reflected XSS via innerHTML in AVideo
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
High
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
High
CVE-2026-33043
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
Medium
CVE-2026-33042
Parse Server affected by empty authData bypassing credential requirement on signup
Medium
CVE-2026-33041
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
High
CVE-2026-33038
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
High
CVE-2026-33036
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
High
CVE-2026-33012
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Medium
CVE-2026-3512
Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter
High
CVE-2026-33011
Nest Fastify HEAD Request Middleware Bypass
Medium
CVE-2026-32770
Parse Server LiveQuery subscription with invalid regular expression crashes server
Medium
CVE-2026-32742
Parse Server session creation endpoint allows overwriting server-generated session fields
Medium
CVE-2026-32878
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
High
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Low
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
High
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
Medium
CVE-2026-32636
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
Critical
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
High
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color
High
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
High
CVE-2026-33013
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.