Medium
CVE-2026-28181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-61974
Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-28189
Participants Database <= 2.7.8.4 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-14239
Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28170
Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28191
The Grid <= 2.7.9.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-16611
Product Feed PRO for WooCommerce <= 13.5.6 - Unauthenticated Information Exposure
Medium
CVE-2026-28186
Travelfic Toolkit <= 1.5.1 - Missing Authorization
High
CVE-2026-28176
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28156
Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-28168
CubeWP <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-10308
Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
Medium
CVE-2026-13168
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-28161
Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-18807
ECS <= 4.3.7 - Missing Authorization
High
CVE-2026-28158
Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-13612
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure
Medium
CVE-2026-28159
Service Finder Booking <= 6.2 - Missing Authorization
Medium
CVE-2026-28188
Hydra Booking <= 1.2.2 - Missing Authorization
Medium
CVE-2026-28174
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
High
ghsa-pfvm-w89x-94jw
SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)
High
ghsa-jwjp-4649-v8jp
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
Medium
CVE-2026-3639
PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-18146
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.