Medium
CVE-2026-24606
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
Medium
CVE-2025-59021
TYPO3 CMS Allows Broken Access Control in Redirects Module
Medium
CVE-2025-59020
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
High
CVE-2026-22814
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
Critical
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Medium
CVE-2026-22809
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
High
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
Medium
CVE-2026-76232
Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file
Medium
CVE-2026-76233
Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file
Medium
CVE-2026-76231
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies
Medium
CVE-2026-76230
Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration
Medium
CVE-2026-76229
Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository
Medium
CVE-2026-76228
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
Critical
CVE-2025-68924
UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
Critical
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
Medium
CVE-2025-15513
Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation
Medium
CVE-2026-0734
WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter
Medium
CVE-2026-0812
LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page
High
CVE-2025-14770
Shipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' Parameter
Medium
CVE-2025-15376
Stopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery
Medium
CVE-2026-0739
WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
Medium
CVE-2026-0813
Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page
Medium
CVE-2025-15512
Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.