Medium
CVE-2026-67332
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Medium
CVE-2026-53509
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Medium
CVE-2026-11798
Social Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
High
CVE-2026-53874
picklescan missing detection by simple obfuscation of a `builtins.eval` call
High
CVE-2026-1777
SageMaker Python SDK has Exposed HMAC
High
CVE-2025-70560
Boltz contains an insecure deserialization vulnerability in its molecule loading functionality
Medium
CVE-2026-25517
Wagtail has improper permission handling on admin preview endpoints
High
CVE-2026-1778
SageMaker Python SDK has Insecure TLS Configuration
Medium
CVE-2026-12041
Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting
High
CVE-2026-14495
DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token
Low
CVE-2026-1703
pip Path Traversal vulnerability
Medium
CVE-2025-69207
Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning
High
CVE-2026-14489
WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter
Critical
CVE-2026-12153
WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action
Medium
CVE-2026-12097
User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification
Medium
CVE-2026-10570
Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values
Medium
CVE-2026-9731
Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-14500
Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
High
CVE-2026-9700
Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter
Critical
CVE-2026-9701
Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
High
CVE-2026-9842
Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities
Critical
CVE-2026-14487
Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter
High
CVE-2026-14482
多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.