Published vulnerability pages
Website Security Risk Index — Page 14
Current vulnerabilities, affected platforms, and fix guidance for website owners and developers.
Browse by topic
Security risk categories
46 categories with published guidance
Memory Corruption
409Browse published Memory Corruption vulnerabilities, affected products, and practical fix guidance.
Authorization Bypass
373Browse published Authorization Bypass vulnerabilities, affected products, and practical fix guidance.
WordPress
350Browse published WordPress vulnerabilities, affected products, and practical fix guidance.
Information Disclosure
320Browse published Information Disclosure vulnerabilities, affected products, and practical fix guidance.
Remote Code Execution
303Browse published Remote Code Execution vulnerabilities, affected products, and practical fix guidance.
Cross-site Scripting
260Browse published Cross-site Scripting vulnerabilities, affected products, and practical fix guidance.
Network Security
253Browse published Network Security vulnerabilities, affected products, and practical fix guidance.
Input Validation
243Browse published Input Validation vulnerabilities, affected products, and practical fix guidance.
Web Application
239Browse published Web Application vulnerabilities, affected products, and practical fix guidance.
Windows
216Browse published Windows vulnerabilities, affected products, and practical fix guidance.
API Security
215Browse published API Security vulnerabilities, affected products, and practical fix guidance.
Browser
215Browse published Browser vulnerabilities, affected products, and practical fix guidance.
Denial of Service
215Browse published Denial of Service vulnerabilities, affected products, and practical fix guidance.
Microsoft
212Browse published Microsoft vulnerabilities, affected products, and practical fix guidance.
PHP
199Browse published PHP vulnerabilities, affected products, and practical fix guidance.
Path Traversal
167Browse published Path Traversal vulnerabilities, affected products, and practical fix guidance.
Authentication Bypass
118Browse published Authentication Bypass vulnerabilities, affected products, and practical fix guidance.
Arbitrary File Write
116Browse published Arbitrary File Write vulnerabilities, affected products, and practical fix guidance.
Privilege Escalation
113Browse published Privilege Escalation vulnerabilities, affected products, and practical fix guidance.
Linux
94Browse published Linux vulnerabilities, affected products, and practical fix guidance.
DevOps
81Browse published DevOps vulnerabilities, affected products, and practical fix guidance.
SQL Injection
72Browse published SQL Injection vulnerabilities, affected products, and practical fix guidance.
Cryptography
68Browse published Cryptography vulnerabilities, affected products, and practical fix guidance.
SSRF
61Browse published SSRF vulnerabilities, affected products, and practical fix guidance.
Python
59Browse published Python vulnerabilities, affected products, and practical fix guidance.
Java
57Browse published Java vulnerabilities, affected products, and practical fix guidance.
IDOR
56Browse published IDOR vulnerabilities, affected products, and practical fix guidance.
WooCommerce
53Browse published WooCommerce vulnerabilities, affected products, and practical fix guidance.
Unsafe Deserialization
51Browse published Unsafe Deserialization vulnerabilities, affected products, and practical fix guidance.
File Upload
47Browse published File Upload vulnerabilities, affected products, and practical fix guidance.
npm
44Browse published npm vulnerabilities, affected products, and practical fix guidance.
Joomla
41Browse published Joomla vulnerabilities, affected products, and practical fix guidance.
Supply Chain
39Browse published Supply Chain vulnerabilities, affected products, and practical fix guidance.
Cloud Security
36Browse published Cloud Security vulnerabilities, affected products, and practical fix guidance.
CSRF
33Browse published CSRF vulnerabilities, affected products, and practical fix guidance.
Race Condition
31Browse published Race Condition vulnerabilities, affected products, and practical fix guidance.
PDF Editor
28Browse published PDF Editor vulnerabilities, affected products, and practical fix guidance.
Industrial Control
27Browse published Industrial Control vulnerabilities, affected products, and practical fix guidance.
.NET
23Browse published .NET vulnerabilities, affected products, and practical fix guidance.
File Deletion
23Browse published File Deletion vulnerabilities, affected products, and practical fix guidance.
Open Redirect
16Browse published Open Redirect vulnerabilities, affected products, and practical fix guidance.
Node.js
15Browse published Node.js vulnerabilities, affected products, and practical fix guidance.
SAML
13Browse published SAML vulnerabilities, affected products, and practical fix guidance.
Virtualization
13Browse published Virtualization vulnerabilities, affected products, and practical fix guidance.
Drupal
6Browse published Drupal vulnerabilities, affected products, and practical fix guidance.
Unix Domain Sockets
5Browse published Unix Domain Sockets vulnerabilities, affected products, and practical fix guidance.
Published security risks
Showing 469–504 of 2230 published risks.
CVE-2023-37507 DevOps Plan vulnerability
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.
Updated Jul 21, 2026
CVE-2026-15927 mirror registry for Red Hat OpenShift 2 vulnerability
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
Updated Jul 21, 2026
CVE-2026-3182 ManageEngine Endpoint Central vulnerability
Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.
Updated Jul 21, 2026
CVE-2026-8593 Checkmk vulnerability
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
Updated Jul 21, 2026
CVE-2026-3183 ManageEngine ADSelfService Plus vulnerability
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
Updated Jul 21, 2026
CVE-2026-15370 Red Hat Enterprise Linux 10 vulnerability
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Updated Jul 21, 2026
CVE-2026-64606 Apache Fory vulnerability
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Updated Jul 21, 2026
CVE-2026-64608 Apache Fory vulnerability
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Updated Jul 21, 2026
CVE-2026-62415 Membership Pro extension for Joomla vulnerability
The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.
Updated Jul 21, 2026
CVE-2026-64609 Apache Fory vulnerability
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Updated Jul 21, 2026
CVE-2026-56647 windows 10 1607 vulnerability
Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network.
Updated Jul 19, 2026
CVE-2026-56648 windows 10 1607 vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.
Updated Jul 19, 2026
CVE-2026-56649 windows 10 1607 vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-56650 windows 10 1607 vulnerability
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.
Updated Jul 19, 2026
CVE-2026-57083 windows 10 1607 vulnerability
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
Updated Jul 19, 2026
CVE-2026-57084 windows 10 1607 vulnerability
Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
Updated Jul 19, 2026
CVE-2026-57085 windows 10 1607 vulnerability
Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
Updated Jul 19, 2026
CVE-2026-57087 windows 10 1607 vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-57088 windows 10 1809 vulnerability
Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.
Updated Jul 19, 2026
CVE-2026-57089 windows 10 1607 vulnerability
Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-57090 windows 10 1607 vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-57091 windows 10 1607 vulnerability
Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.
Updated Jul 19, 2026
CVE-2026-57092 windows 10 1607 vulnerability
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
Updated Jul 19, 2026
CVE-2026-57093 windows 10 1607 vulnerability
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Jul 19, 2026
CVE-2026-57094 windows 10 1607 vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-48252 experience manager vulnerability
Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48253 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48254 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48255 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48257 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48259 experience manager vulnerability
Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48260 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48261 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48262 experience manager vulnerability
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48263 experience manager vulnerability
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Updated Jul 19, 2026
CVE-2026-48310 experience manager vulnerability
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
Updated Jul 19, 2026