Średnia
CVE-2026-33866
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 71 600
Średnia
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Średnia
CVE-2025-14732
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Wysoka
CVE-2026-3499
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
Krytyczna
CVE-2026-3296
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
Średnia
CVE-2026-4401
Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
Średnia
CVE-2026-2263
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
Średnia
CVE-2026-4394
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
Średnia
CVE-2026-4406
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
Wysoka
Wykorzystywana w atakach
CVE-2026-34197
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Średnia
CVE-2026-33227
Apache ActiveMQ: Improper validation and restriction of a classpath path name
Krytyczna
CVE-2026-1114
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
Średnia
CVE-2026-4065
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
Średnia
CVE-2026-1839
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
Średnia
CVE-2026-39434
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.26 - Authenticated (Shop Manager+) PHP Object Injection
Wysoka
CVE-2026-3396
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
Średnia
CVE-2026-34899
LTL Freight Quotes – Worldwide Express Edition <= 5.2.1 - Missing Authorization
Wysoka
CVE-2026-34894
Integrio Core < 1.2.8 - Unauthenticated Local File Inclusion
Średnia
CVE-2026-1672
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
Średnia
CVE-2026-4654
Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
Wysoka
CVE-2026-34893
Thegov Core < 2.0.23 - Unauthenticated Local File Inclusion
Średnia
CVE-2026-2509
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
Średnia
CVE-2026-39433
WPAMS - Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Średnia
CVE-2026-34898
Event Tickets Manager for WooCommerce <= 1.5.3 - Missing Authorization
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.