Medium
CVE-2026-9702
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-49765
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49775
Welcart e-Commerce <= 2.11.28 - Missing Authorization
High
CVE-2026-49781
OttoKit: All-in-One Automation Platform <= 1.1.27 - Unauthenticated PHP Object Injection
High
CVE-2026-49109
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49771
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-49767
wpForo Forum <= 3.1.0 - Missing Authorization
High
CVE-2026-49763
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-49768
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49764
RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization
High
CVE-2026-49106
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-49108
Moderno < 1.43 - Unauthenticated PHP Object Injection
Medium
CVE-2025-10268
Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Directory Traversal to Unauthenticated Folder Content Disclosure
High
CVE-2026-49778
WPFunnels Pro <= 2.9.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-52793
Froxlor's API Authentication bypasses 2FA Authentication
High
CVE-2026-49143
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
High
CVE-2026-49144
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
High
CVE-2026-7888
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Critical
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
High
CVE-2026-42342
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
High
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
High
CVE-2026-41234
Froxlor: BIND Zone File Injection via TXT Record Content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.