Medium
CVE-2026-58657
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-63671
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
Medium
CVE-2026-61453
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
Medium
CVE-2026-59193
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Medium
CVE-2026-66676
Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 - Missing Authorization
Medium
CVE-2026-73999
Cooked – Recipe Management <= 1.16.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-74000
Simple Membership <= 4.8.2 - Missing Authorization
Medium
CVE-2026-74002
Booking Calendar <= 11.7 - Missing Authorization
Medium
CVE-2026-74017
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
Medium
CVE-2026-74005
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Cross-Site Request Forgery
Medium
CVE-2026-78294
Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-78295
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery
Medium
CVE-2026-78528
BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 - Missing Authorization
Unrated
drupal-core-2026-013
Drupal core - SA-CORE-2026-013
High
CVE-2026-87935
Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
Critical
CVE-2026-87796
Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
High
CVE-2026-68904
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Medium
CVE-2026-86311
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-89064
All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
High
CVE-2026-81192
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
Critical
CVE-2026-61560
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Medium
CVE-2026-92465
WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-86792
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist,
Medium
CVE-2026-88798
Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.