Medium
CVE-2026-25152
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
Low
CVE-2026-1518
Keycloak Server-Side Request Forgery (SSRF) vulnerability
Low
CVE-2025-13881
Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes
High
CVE-2026-24788
RaspAP raspap-webgui contains an OS Command Injection vulnerability
Medium
CVE-2026-39585
Booktics <= 1.0.16 - Missing Authorization
High
CVE-2026-39538
Mikado Core <= 1.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25023
Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 - Unauthenticated Information Exposure
Medium
CVE-2026-25024
ThirstyAffiliates <= 3.11.9 - Cross-Site Request Forgery
High
CVE-2026-25326
CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25022
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
Medium
CVE-2026-23835
LobeHub Vulnerable to Improper Authorization in Presigned Upload
Medium
CVE-2026-25325
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure
Medium
CVE-2026-39604
MyBookTable Bookstore <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-25324
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-23978
Gyan Elements <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-39603
Grand Photography <= 5.7.8 - Cross-Site Request Forgery
Medium
CVE-2026-1369
Conditional CAPTCHA <= 4.0.0 - Unauthenticated Open Redirect
Medium
CVE-2026-39602
Order Tracking <= 3.4.4 - Missing Authorization
Medium
CVE-2020-37044
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicio
High
CVE-2020-37041
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with p
High
CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Medium
CVE-2026-25129
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
Critical
CVE-2026-25141
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.