Medium
CVE-2026-92714
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-91707
Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Medium
CVE-2026-92561
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
High
CVE-2026-92619
Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
High
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
Medium
CVE-2026-75523
Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets
Medium
CVE-2026-75831
Grav: Stored XSS via Markdown audio/video media <source> URL
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Medium
CVE-2026-72832
Grav: Stored XSS via quoted-attribute bypass in detectXss
Medium
CVE-2026-85717
AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target
Medium
CVE-2026-85720
AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request
High
CVE-2026-85721
AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
Low
CVE-2026-85716
AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses
High
CVE-2026-85756
SSH.NET: ScpClient allows server-side RCE via default SCP path handling
Medium
CVE-2026-73245
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
High
CVE-2026-69089
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
High
CVE-2026-69088
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
High
CVE-2026-73247
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
High
CVE-2026-65608
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Low
CVE-2026-86071
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
High
CVE-2026-85715
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
Low
CVE-2026-61700
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
High
CVE-2026-69197
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
High
CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.