Mittel
CVE-2026-4123
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.436
Mittel
CVE-2026-12995
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Hoch
CVE-2026-94504
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Hoch
CVE-2026-89412
TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
Mittel
CVE-2026-85653
Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
Hoch
CVE-2026-12470
CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
Mittel
CVE-2026-93655
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Kritisch
CVE-2026-13355
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Kritisch
CVE-2026-19658
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Mittel
CVE-2026-82355
When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting
Kritisch
CVE-2026-86473
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, th
Mittel
CVE-2026-75158
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holdin
Mittel
CVE-2026-94117
HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.3 - Authenticated (Administrator+) SQL Injection
Mittel
CVE-2026-90985
WPC Smart Compare for WooCommerce <= 6.6.0 - Unauthenticated Information Exposure
Mittel
CVE-2026-93511
Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events
Mittel
CVE-2026-90951
Paid Member Subscriptions <= 3.0.0 - Missing Authorization
Mittel
CVE-2026-84741
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Information Exposure
Mittel
CVE-2026-89331
FluentBoards 1.95 - 2.0.15 - Unauthenticated Information Exposure
Hoch
CVE-2026-92235
WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
Mittel
CVE-2026-91024
Booking Manager <= 2.1.20 - Authenticated (Author+) SQL Injection
Mittel
CVE-2026-83555
Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization
Mittel
CVE-2026-81338
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) HTML Injection
Mittel
CVE-2026-87074
Forminator Forms <= 1.57.2.0 - Missing Authorization
Mittel
CVE-2026-80342
Payment Plugins for PayPal WooCommerce <= 2.0.26 - Unauthenticated Insecure Direct Object Reference
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.