Mittel
CVE-2026-15334
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.445
Mittel
CVE-2026-15333
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
Mittel
CVE-2026-15648
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Mittel
CVE-2026-15653
Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
Mittel
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
Hoch
CVE-2026-8789
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
Mittel
CVE-2026-45339
Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
Hoch
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Hoch
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Hoch
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Hoch
CVE-2026-59931
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Kritisch
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Hoch
CVE-2026-73418
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Kritisch
CVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Mittel
CVE-2026-73419
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Mittel
CVE-2026-15100
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Mittel
CVE-2026-11354
Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Mittel
CVE-2025-9205
MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Mittel
CVE-2026-13464
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Mittel
CVE-2026-6454
Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
Hoch
CVE-2026-12736
WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Mittel
CVE-2026-15420
Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
Hoch
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Hoch
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.