Wysoka
CVE-2026-75927
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 71 534
Średnia
CVE-2026-19802
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
Krytyczna
CVE-2026-82533
DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API
Krytyczna
CVE-2026-75595
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Średnia
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
Wysoka
CVE-2026-69222
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
Średnia
CVE-2026-73262
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Średnia
42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
Średnia
CVE-2026-85063
node-csv: Prototype replacement still reachable via columns path
Średnia
CVE-2026-72925
SWC HTML minifier may allow script element breakout when minifying embedded JSON
Wysoka
CVE-2026-76009
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
Średnia
CVE-2026-8615
ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
Średnia
CVE-2026-84908
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
Średnia
CVE-2026-19946
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Wysoka
CVE-2026-83593
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
Średnia
CVE-2026-75905
WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
Średnia
CVE-2026-11821
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
Średnia
CVE-2026-19945
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
Średnia
CVE-2026-12259
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. T
Średnia
CVE-2026-19944
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
Średnia
CVE-2026-19797
User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
Wysoka
CVE-2026-17553
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
Średnia
CVE-2026-7804
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
Średnia
CVE-2026-75966
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.