High
CVE-2026-14333
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,515
Medium
CVE-2026-12901
GetPaid <= 2.8.54 - Unauthenticated Payment Bypass
Medium
CVE-2026-12501
Travel Engine <= 6.8.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-14843
Events Made Easy <= 3.1.3 - Insecure Direct Object Reference to Unauthenticated Person Data Modification
Medium
CVE-2026-14849
Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure
High
CVE-2026-4259
Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-15258
Product Feed Manager for WooCommerce <= 7.6.0 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2026-15982
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
Medium
CVE-2026-14927
FluentCart <= 1.5.2 - Insecure Direct Object Reference to Unauthenticated Order PII Disclosure
Medium
CVE-2026-14833
Lightbox with PhotoSwipe <= 5.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-9341
Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
Medium
CVE-2026-14930
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Unauthenticated Arbitrary Media Upload
Medium
CVE-2026-14834
Mailgun for WordPress <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription
Unrated
871
Balbooa Forms (com_baforms) - Other
Unrated
870
Balbooa Forms (com_baforms) - Other
High
CVE-2026-56259
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution
Medium
CVE-2026-61955
sync-basalam <= 3.0.2 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-61956
sync-basalam <= 1.9.1 - Cross-Site Request Forgery
Medium
CVE-2026-61952
Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 - Missing Authorization
Medium
CVE-2026-49844
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
High
ghsa-h4g2-xfmw-q2c9
Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset
Critical
CVE-2026-54159
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
High
CVE-2026-73496
mcp-atlassian: Arbitrary server-side file read via attachment upload
High
ghsa-xrmc-c5cg-rv7x
SafeInstall agent guard shell parsing can miss raw package execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.