Medium
CVE-2026-71437
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Low
CVE-2026-55825
Contao: Possible path traversal in job download URIs
Medium
CVE-2026-71436
Mermaid XY Charts are vulnerable to an infinite loop DoS
Low
CVE-2026-55824
Contao crawler leaks auth credentials to external hosts
Medium
CVE-2026-71435
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
Medium
CVE-2026-71434
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Medium
CVE-2026-64662
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Medium
CVE-2026-64663
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
High
CVE-2026-64665
Statamic: Account takeover via OAuth email matching without email-verification check
Medium
CVE-2026-64664
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
Medium
CVE-2026-71433
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
Medium
CVE-2026-11907
Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
Critical
CVE-2026-14364
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
Critical
CVE-2026-14365
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
Medium
CVE-2026-12801
Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
Unrated
CVE-2026-64640
Apache Polaris did not consistently validate storage locations supplied during table and view registration.
Medium
CVE-2026-18501
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
Medium
CVE-2026-0673
Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
High
CVE-2026-65571
69 Clothing | Brand Store & Fashion Boutique WordPress Theme <= 1.2.11.1 - Unauthenticated PHP Object Injection
Critical
CVE-2026-12872
Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-17020
Salon Booking System – Free Version < 10.31.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure
Medium
CVE-2026-65582
AI Hub - Startup & Technology WordPress Theme <= 1.3.10 - Authenticated (Subscriber+) Arbitrary File Dowload
Medium
CVE-2026-15241
AI ChatBot for WooCommerce – WoowBot < 4.8.4 - Missing Authorization to Unauthenticated AI API Key Abuse
High
CVE-2026-65575
Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor <= 1.5.3 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.