Medium
CVE-2026-80433
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-81271
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery
Medium
CVE-2026-81273
FluentBooking Pro <= 2.2.4 - Cross-Site Request Forgery
Medium
CVE-2026-81274
Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.67 - Missing Authorization
Medium
CVE-2026-81276
Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.23 - Missing Authorization
Low
CVE-2026-81272
FluentPlayer Pro <= 1.3.2 - Missing Authorization
Medium
CVE-2026-77790
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-78275
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Deletion
High
CVE-2026-78274
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2026-14216
Booking for Appointments and Events Calendar – Amelia < 2.4.7 - Missing Authorization
Medium
CVE-2026-81277
Suggestion Engine for WooCommerce <= 2.0.11 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-74930
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.2.0 - 4.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-77754
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization
Medium
CVE-2026-14326
Timetics < 1.0.62 - Authenticated (Staff+) Insecure Direct Object Reference
Critical
CVE-2026-19092
Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation
Medium
CVE-2026-13172
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Unauthenticated Information Exposure
Medium
CVE-2026-12514
Shared Files Pro < 1.7.70 & Shared Files Free < 1.7.67 - Unauthenticated Limited File Upload
Medium
CVE-2026-74929
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker < 4.0.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-15985
Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
Critical
CVE-2026-18080
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
Medium
CVE-2026-2388
Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2026-65087
NVIDIA NemoClaw contains a vulnerability where an attacker could cause
Medium
CVE-2026-54338
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Medium
CVE-2026-55605
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.