Medium
CVE-2026-84847
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-81737
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-81423
Accept Stripe Payments < 2.1.4 - Unauthenticated Open Redirect
Medium
CVE-2026-84849
Pre-Orders for WooCommerce <= 2.3.1 - Missing Authorization
High
CVE-2026-84753
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-85305
SEOPress – AI SEO Plugin & On-site SEO <= 10.1 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2026-19859
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-19862
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection
Medium
CVE-2026-84936
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
High
CVE-2026-84815
Enfold - Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-19084
Shared Files Pro < 1.7.70 - Unauthenticated Arbitrary File Read
High
CVE-2026-84834
JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-68921
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
High
CVE-2026-65842
Plate: SSRF with response disclosure in DOCX image embedding
High
CVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
High
CVE-2026-62232
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Medium
CVE-2026-61450
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Medium
CVE-2026-61455
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
High
CVE-2026-61704
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
Medium
CVE-2026-3852
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Unrated
CVE-2026-84921
drupal/webform_submissions_delete - SA-CONTRIB-2026-133
Unrated
CVE-2026-84920
drupal/unpublished_node_permissions - SA-CONTRIB-2026-132
Unrated
CVE-2026-84919
drupal/photoswipe - SA-CONTRIB-2026-131
Unrated
CVE-2026-84918
drupal/monobank - SA-CONTRIB-2026-130
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.