Kritisch
CVE-2026-47686
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.534
Hoch
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Mittel
CVE-2026-74004
Gravity Booster – Styles & Layouts for Gravity Forms <= 6.1 - Missing Authorization
Mittel
CVE-2026-74003
RTMForm Builder <= 1.2.7 - Missing Authorization
Mittel
CVE-2026-74006
WP Table Builder – Drag & Drop Table Builder <= 2.2.0 - Missing Authorization
Mittel
CVE-2026-74007
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 - Unauthenticated Information Exposure
Mittel
CVE-2026-74008
Shortcodes and extra features for Phlox theme <= 2.17.22 - Unauthenticated Information Exposure
Mittel
CVE-2026-74009
Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
Kritisch
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Hoch
CVE-2026-19693
extract-zip allows arbitrary file writes through symlink archive entries
Hoch
CVE-2026-53728
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
Hoch
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
Hoch
CVE-2026-11801
WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
Hoch
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
Hoch
CVE-2026-73393
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting
Mittel
CVE-2026-32549
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
Hoch
CVE-2026-73339
Modern Events Calendar < 7.35.0 - Unauthenticated SQL Injection
Mittel
CVE-2026-32466
Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection
Hoch
CVE-2026-32463
Sync Post With Other Site <= 1.9.3 - Authenticated (Contributor+) Arbitrary File Upload
Mittel
CVE-2026-28571
Contact Form to Chat Apps | Click to Chat to Order – FormyChat <= 2.15.7 - Missing Authorization
Nicht bewertet
CVE-2026-74900
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from o
Nicht bewertet
CVE-2026-74901
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify
Nicht bewertet
CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known de
Nicht bewertet
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.