Medium
CVE-2026-77387
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,515
Medium
CVE-2026-114076
Trigger.dev: Blind SSRF via alert-channel webhook
High
ghsa-pp95-gc86-jq6q
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
High
CVE-2026-85650
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
High
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Medium
CVE-2026-39718
Wallstreet <= 2.8.6 - Cross-Site Request Forgery
Medium
CVE-2026-59944
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
High
CVE-2026-114094
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Medium
CVE-2026-114095
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
High
CVE-2026-114096
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
CVE-2026-114097
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
CVE-2026-114098
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Medium
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Critical
CVE-2026-92084
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Medium
CVE-2026-97343
Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
High
CVE-2026-94505
Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
High
CVE-2026-61586
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
Medium
CVE-2026-92974
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
Medium
CVE-2026-93896
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
High
CVE-2026-97660
WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
Medium
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter
Medium
CVE-2026-103421
WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
Medium
CVE-2026-100157
WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
Medium
CVE-2026-103519
WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.