High
CVE-2026-49055
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-42775
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48970
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.10 - Missing Authorization
High
CVE-2026-49780
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation
Medium
CVE-2026-34892
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization
Medium
CVE-2026-49056
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 - Unauthenticated Information Exposure
High
CVE-2026-48966
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-48867
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48965
Backup, Restore and Migrate your sites with XCloner <= 4.8.6 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-48967
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-35212
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable bod
Medium
CVE-2026-47265
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
Medium
CVE-2026-34993
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
Medium
CVE-2026-46718
Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes
Medium
CVE-2026-9732
EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-7421
Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
High
CVE-2026-3514
Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'
Medium
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Critical
CVE-2026-5076
ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
Medium
CVE-2026-5074
ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
High
CVE-2026-5073
ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter
High
CVE-2026-1829
Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-10291
Claw Orchestrator has inefficient regular expression complexity via validateRegex()
Medium
CVE-2026-48873
Montonio for WooCommerce <= 10.1.2 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.