High
CVE-2026-66657
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2026-61962
WP BASE Booking of Appointments, Services and Events <= 6.3.0 - Unauthenticated Remote Code Execution
Critical
CVE-2026-14182
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Privilege Escalation
Critical
CVE-2026-61967
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation
Critical
CVE-2026-27543
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation
High
CVE-2026-27539
Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27535
Solace Extra <= 1.6.0 - Missing Authorization
Medium
CVE-2026-66660
Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 - Missing Authorization
Medium
CVE-2026-27538
WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
Medium
CVE-2026-66655
MultiParcels Shipping For WooCommerce <= 1.30.36 - Reflected Cross-Site Scripting
High
CVE-2026-66659
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection
Medium
CVE-2026-66654
Vehica Core <= 1.0.104 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-27999
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
Medium
CVE-2026-14290
Embed Google Photos Album Easily <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-11578
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
Medium
CVE-2026-68871
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deploy
Medium
CVE-2026-68872
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team
Medium
CVE-2026-16974
Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
Critical
CVE-2026-28672
Apache Ranger has a Command Injection vulnerability
Medium
CVE-2026-18654
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Medium
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
Medium
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode streams
High
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Medium
CVE-2026-71554
h2: Duplicate Host header could facilitate request smuggling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.