Mittel
CVE-2026-3595
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.593
Kritisch
CVE-2026-3596
Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action
Hoch
CVE-2026-3614
AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Hoch
CVE-2026-5050
Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
Mittel
CVE-2026-25219
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Mittel
CVE-2026-4032
CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode
Mittel
CVE-2026-5070
Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content
Mittel
CVE-2026-3878
WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'
Mittel
CVE-2026-3885
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
Mittel
CVE-2026-3299
WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode
Kritisch
CVE-2026-4880
Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication
Mittel
CVE-2026-4949
ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
Mittel
CVE-2025-15636
Video Gallery – YouTube Gallery & Responsive Video Playlist <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Mittel
CVE-2026-6372
Accept Cryptocurrencies with Plisio <= 2.0.6 - Missing Authorization
Mittel
CVE-2026-6370
Mini Ajax Cart for WooCommerce <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
Mittel
CVE-2025-15635
Smart Online Order for Clover <= 1.6.4 - Cross-Site Request Forgery
Mittel
CVE-2025-63029
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection
Mittel
CVE-2025-53444
UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery
Mittel
CVE-2026-40784
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 1.91.2 - Authenticated (Board Member+) Insecure Direct Object Reference
Niedrig
ghsa-g4vj-cjjj-v7hg
Defense in Depth update for NuGet Client
Hoch
CVE-2026-2332
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Hoch
CVE-2026-41134
Kiota: Code Generation Literal Injection
Niedrig
ghsa-fj52-5g4h-gmq8
pyLoad's Session Not Invalidated After Permission Changes
Mittel
CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.