Medium
CVE-2026-70609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-70608
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
High
CVE-2026-18510
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-18400
Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting
High
CVE-2026-15459
WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
Medium
CVE-2026-70607
Electron: window.open features string controls some window options considered privileged
Medium
CVE-2026-70606
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Medium
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
High
CVE-2026-70604
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Medium
CVE-2026-70602
Electron: Extension tab APIs operate across session boundaries
Medium
CVE-2026-70603
Electron: shell.openPath path validation bypass via embedded null byte
High
CVE-2026-70601
Electron: Context isolation bypass via Function.prototype.bind hijack
Low
CVE-2026-70600
Electron: Cross-origin iframe can position native autofill popup
Medium
CVE-2026-70599
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Medium
CVE-2026-71293
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
Low
CVE-2026-70598
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Medium
CVE-2026-70597
Electron: Parent process code-sign check is spoofable
High
CVE-2026-16636
FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
High
CVE-2026-15991
File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
High
CVE-2026-18325
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
Medium
CVE-2026-53949
Ghost Content API filter bypass reveals private fields
Medium
CVE-2026-70596
Ghost: Cross-Site Scripting in Feature Image Captions
Medium
CVE-2026-70595
Ghost: Server-Side Request Forgery Mitigation Issue
Medium
CVE-2026-48197
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.