Medium
CVE-2026-11883
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-11570
User Submitted Posts <= 20260607 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-60218
PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-49043
WP Migrate Lite – Migration Made Easy <= 2.7.8 - Cross-Site Request Forgery
High
CVE-2026-11794
Advanced Form Integration <= 2.1.0 - Unauthenticated Privilege Escalation
High
CVE-2026-46373
SQLFluff: Recursive Stack Overflow in Parser
High
CVE-2026-46374
SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser
Critical
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Medium
CVE-2026-47767
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Critical
CVE-2025-6254
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation
High
CVE-2026-3018
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
Unrated
pysec-2026-207
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
Medium
CVE-2026-8613
aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
Medium
CVE-2026-8853
MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
Medium
CVE-2026-9019
Easy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters
High
CVE-2026-50636
LimeSurvey has a SQL Injection issue
High
CVE-2026-50635
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
Critical
CVE-2026-9277
shell-quote quote() does not escape newlines in object .op values
Medium
CVE-2026-49818
The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path o
High
CVE-2026-11572
degit has a Command Injection issue
Medium
CVE-2026-41853
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
Medium
CVE-2026-41851
Spring Framework Denial of Service via Unbounded Cache in SpEL
High
CVE-2026-41850
Spring Framework Algorithmic Denial of Service via SpEL Expressions
Low
CVE-2026-41852
Spring Framework Arbitrary Method Invocation in SpEL Expressions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.