Medium
CVE-2026-63220
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-15895
jsii-diff: Command Injection via npm: package argument
Medium
CVE-2026-56818
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
Medium
CVE-2026-54164
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
Medium
CVE-2026-66062
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
Medium
CVE-2026-72744
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
Medium
CVE-2026-75838
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
Medium
CVE-2026-62996
Smarty Security stream restriction bypass through stream: resource
Medium
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories
Critical
CVE-2026-72780
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Medium
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corp
Medium
CVE-2026-66461
SMEPay: UPI Gateway for WooCommerce <= 1.0.5 - Missing Authorization
Medium
CVE-2026-14238
Vitepos <= 3.5.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-66446
If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-14237
Vitepos <= 3.5.0 - Authenticated (Outlet Manager+) Privilege Escalation
Medium
CVE-2026-66455
ReactPress – Create React App for WordPress <= 3.4.0 - Missing Authorization
Medium
CVE-2026-19075
All-in-One Video Gallery <= 4.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-66459
SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot) <= 2.4.2 - Missing Authorization
High
CVE-2026-66458
RealPress – Real Estate Plugin <= 1.1.2 - Unauthenticated SQL Injection
High
CVE-2026-66436
Active Woot Products Tables for WooCommerce. 100% FREE <= 1.1.1 - Unauthenticated SQL Injection
High
CVE-2026-14293
Autopay / Blue Media for WooCommerce <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66426
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66456
Profile Extra Fields by BestWebSoft <= 1.3.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
CVE-2026-18786
CheckView <= 2.3.1 - Unauthenticated REST API Authorization Bypass to Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.