High
CVE-2026-73625
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-73619
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
Medium
CVE-2026-28182
AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-13177
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
Critical
CVE-2026-28192
Piotnet Addons For Elementor Pro <= 7.1.67 - Unauthenticated Arbitrary File Upload
High
CVE-2025-53345
Thim Core <= 2.3.3 - Authenticated (Subscriber+) Remote Code Execution
High
CVE-2026-28187
Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28154
Samex - Clean, Minimal Shop WooCommerce WordPress <= 2.5 - Reflected Cross-Site Scripting
Critical
CVE-2026-28185
Log in with Google <= 1.4.2 - Authentication Bypass
Medium
CVE-2026-14230
ECS <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-28175
Visitors Traffic Real Time Statistics <= 8.11 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-73403
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
Critical
CVE-2026-61979
SAML Single Sign On – SSO Login <= 5.4.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-14229
ECS <= 4.3.7 - Missing Authorization to Unauthenticated Private Content Disclosure
Medium
CVE-2026-61984
WPMobile.App <= 11.77 - Missing Authorization
High
CVE-2026-61980
OMGF Pro <= 5.2.7 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-28155
Do Lasso <= 358 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-28173
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion
Medium
CVE-2026-28157
Do Lasso <= 358 - Authenticated (Subscriber+) Path Traversal
Medium
CVE-2026-73401
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization
Medium
CVE-2026-18216
Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation
Medium
CVE-2026-12976
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-14922
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-16541
Simply Schedule Appointments <= 1.6.12.16 - Authenticated (Team Member+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.