Mittel
CVE-2026-75018
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.445
Mittel
CVE-2026-74853
Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read
Mittel
CVE-2026-85038
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.40 - Unauthenticated Unauthorized B2B Group Assignment
Mittel
CVE-2026-17517
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) < 4.5.1.2 - Missing Authorization
Mittel
CVE-2026-79631
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure
Mittel
CVE-2026-87870
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Mittel
CVE-2026-32480
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Missing Authorization
Kritisch
CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
Mittel
CVE-2026-84066
Directorist: AI-Powered Business Directory, Listings & Classified Ads < 8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Mittel
CVE-2026-12843
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
Mittel
CVE-2026-57777
WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection
Hoch
CVE-2026-19224
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution
Mittel
CVE-2025-15691
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
Mittel
CVE-2026-27086
Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Mittel
CVE-2026-82186
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection
Kritisch
CVE-2024-33663
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Hoch
CVE-2026-77465
toml-node: Uncontrolled Recursion
Hoch
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
Mittel
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Mittel
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Mittel
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
Hoch
CVE-2026-82404
TOON: Prototype pollution when decoding untrusted TOON input
Hoch
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Kritisch
CVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.