High
Exploited in attacks
CVE-2026-60137
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,515
High
CVE-2026-15368
Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover
High
CVE-2026-13158
Everest Toolkit <= 1.2.3 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2026-13157
Theme Demo Import <= 1.1.3 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-14309
Chat On Desk <= 1.0.8 - Unauthenticated Two-Factor Authentication Bypass to Password Reset
Critical
Exploited in attacks
CVE-2026-63030
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
High
CVE-2026-63397
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema
High
CVE-2026-67342
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
High
CVE-2026-67341
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
High
CVE-2026-67340
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
High
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
Critical
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
High
CVE-2026-55578
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
High
CVE-2026-54076
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
High
CVE-2026-54077
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
High
CVE-2026-54540
Pheditor has an authenticated terminal command whitelist bypass
Medium
CVE-2026-9656
HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
Medium
CVE-2026-15094
WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
Unrated
872
jDownloads - Other
Medium
CVE-2026-14503
pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-15759
ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes
High
CVE-2026-13765
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
Medium
CVE-2026-15349
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
High
CVE-2026-13352
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.