Medium
CVE-2026-11392
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Medium
CVE-2026-5069
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
Medium
ghsa-382c-vx95-w3p5
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data
Medium
CVE-2026-53760
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
High
CVE-2026-56382
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
Low
CVE-2026-56394
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
High
CVE-2026-49485
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Critical
CVE-2026-14894
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
High
ghsa-52vm-mxx8-f227
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
Medium
ghsa-q6gh-6v2r-hjv3
Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers
High
ghsa-387m-935m-c4vw
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Unrated
868
Breezingforms - Other
High
CVE-2026-12597
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback
High
CVE-2026-12595
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
High
CVE-2026-12598
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback
High
CVE-2026-13492
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
Medium
CVE-2026-57807
WordPress Single Sign-On (SSO) - Multisite Premium <= 38.5.8 - Missing Authorization
High
CVE-2026-57738
777 <= 1.13.0 - Unauthenticated PHP Object Injection
High
CVE-2026-57715
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57810
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.4 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-59515
AI Copilot – Content Generator <= 1.5.4 - Unauthenticated SQL Injection
High
CVE-2026-59514
BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection
High
CVE-2026-59518
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-57710
WoowBot Pro Max <= 14.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.