Medium
CVE-2026-11454
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-7105
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
Medium
CVE-2026-15281
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-15307
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
Medium
CVE-2026-15830
Django GeoDjango vulnerable to denial of service through deeply nested geometry collections
Medium
CVE-2026-7456
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
High
CVE-2026-18881
TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
Critical
CVE-2026-5581
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
High
CVE-2026-6079
Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
Medium
CVE-2026-17532
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
Medium
CVE-2026-17505
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
High
CVE-2026-6147
LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
High
CVE-2026-12000
Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
High
CVE-2026-6627
WPFormify <= 1.1.1 - Missing Authorization
Medium
CVE-2026-6972
SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-7693
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
Medium
CVE-2026-5116
Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
High
CVE-2026-70474
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
Medium
CVE-2026-7726
Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
Medium
CVE-2026-73604
Flowise: Incomplete Credential Redaction Exposes Secrets via API
High
CVE-2026-70473
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
High
CVE-2026-7444
Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
Medium
CVE-2026-7441
Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-70472
Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.