Medium
CVE-2026-18946
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-61960
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65565
Survey Maker by AYS <= 5.2.3.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-65574
Abogado - Lawyer WordPress Theme <= 1.18 - Unauthenticated PHP Object Injection
High
CVE-2026-65560
Houzez Property Feed <= 2.5.48 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-16261
Login Social <= 1.0.4 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-66685
Featured Video Plus <= 2.3.3 - Unauthenticated Information Exposure
High
CVE-2025-15028
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-9266
Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation
Medium
CVE-2026-11983
Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax
Medium
CVE-2026-5391
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-5158
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
High
CVE-2026-71321
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
High
CVE-2026-71320
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
Critical
CVE-2026-71319
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Medium
CVE-2026-71318
Nuxt: Unauthorized Component Instantiation via Server Island Props
High
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
High
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
High
CVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Unrated
CVE-2026-18986
drupal/entity_browser - SA-CONTRIB-2026-094
Unrated
CVE-2026-18985
drupal/edit_in_place_field - SA-CONTRIB-2026-093
Medium
CVE-2026-70612
Electron: Sandboxed iframes can launch external protocol handlers
Medium
CVE-2026-70611
Electron: DevTools embedder handler executes arbitrary files via shell open
Medium
CVE-2026-70610
Electron: contextBridge object copy honors prototype setters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.