Wysoka
CVE-2026-25474
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 71 609
Średnia
CVE-2026-1943
YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
Wysoka
CVE-2026-1937
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
Wysoka
CVE-2026-2296
Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter
Niska
CVE-2026-24764
OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
Średnia
CVE-2026-2281
Private Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting
Średnia
CVE-2026-1807
InteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Wysoka
CVE-2026-2019
Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting
Średnia
CVE-2026-1666
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
Średnia
CVE-2026-2633
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
Średnia
CVE-2026-1857
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
Średnia
CVE-2026-1640
Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
Średnia
CVE-2026-1639
Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
Średnia
CVE-2026-1906
PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
Średnia
CVE-2026-1072
Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update
Wysoka
ghsa-hr7j-63v7-vj7g
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Średnia
CVE-2026-1304
Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
Wysoka
CVE-2026-29613
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
Wysoka
ghsa-56f2-hvwg-5743
OpenClaw affected by SSRF in Image Tool Remote Fetch
Średnia
CVE-2026-2023
WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation
Średnia
CVE-2026-28395
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback
Wysoka
CVE-2026-28470
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes
Wysoka
CVE-2026-28458
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access
Wysoka
CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.