High
CVE-2026-66704
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-66444
Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-13505
Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.
High
CVE-2026-8798
Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound
Medium
cddbb0f8-fc73-46d7-80af-edb69227084f
WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery
Medium
cac1c1fa-7d6c-43c3-885e-9be320cb8f83
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass
Medium
c83a2c4d-a264-49ec-85f1-e3f48715d725
WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection
Medium
c3f9898b-0aa0-4dd1-9298-96c853dbef5c
WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
High
CVE-2026-61982
SiteGuard WP Plugin <= 1.8.6 - Unauthenticated Stored Cross-Site Scripting
Medium
92babbbf-74bd-474f-9057-c5022a7d64c7
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
Medium
CVE-2026-14548
Ray Enterprise Translation <= 1.7.3 - Missing Authorization
Medium
80f92f7f-72e7-4d83-9ceb-ed0e11fb8003
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite
Medium
CVE-2026-92991
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Medium
5faaf7d1-2012-42d5-affa-a5ff3388d25a
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element
Medium
CVE-2026-9676
f4 Post Tree <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Parent/Menu Order Modification
Medium
CVE-2026-64638
WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter
Critical
CVE-2026-71851
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Medium
CVE-2026-71850
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
Low
CVE-2026-71849
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Medium
CVE-2026-71848
Hono: Algorithmic Complexity DoS in Language Middleware
Critical
CVE-2026-14526
AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route
Critical
CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
High
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Critical
CVE-2026-63221
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.