Hoch
CVE-2026-2019
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.602
Mittel
CVE-2026-1666
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
Mittel
CVE-2026-2633
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
Mittel
CVE-2026-1857
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
Mittel
CVE-2026-1640
Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
Mittel
CVE-2026-1639
Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
Mittel
CVE-2026-1906
PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
Mittel
CVE-2026-1072
Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update
Hoch
ghsa-hr7j-63v7-vj7g
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Mittel
CVE-2026-1304
Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
Hoch
CVE-2026-29613
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
Hoch
ghsa-56f2-hvwg-5743
OpenClaw affected by SSRF in Image Tool Remote Fetch
Mittel
CVE-2026-2023
WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation
Mittel
CVE-2026-28395
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback
Hoch
CVE-2026-28470
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes
Hoch
CVE-2026-28458
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access
Hoch
CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
Hoch
CVE-2026-28459
OpenClaw has an arbitrary transcript path file write via gateway sessionFile
Hoch
ghsa-hv93-r4j3-q65f
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
Mittel
CVE-2025-11737
VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
Mittel
CVE-2025-12356
Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update
Mittel
CVE-2025-12122
Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Kritisch
CVE-2026-28472
OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated
Mittel
CVE-2025-12074
Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.