High
CVE-2026-45617
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-7052
HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field
High
CVE-2026-6455
WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
Medium
CVE-2026-7552
Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter
High
CVE-2026-9227
GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter
High
CVE-2026-45368
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Medium
CVE-2026-7621
SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
High
CVE-2026-45357
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
Medium
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
High
CVE-2026-9009
Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute
Medium
CVE-2026-7533
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
High
CVE-2026-45260
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Medium
CVE-2026-9644
LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-45162
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Medium
CVE-2026-45065
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
High
CVE-2026-45063
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Medium
CVE-2026-9674
Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability
Medium
CVE-2026-48927
Jenkins buildgraph-view Plugin does not escape the build URL
Medium
CVE-2026-48926
Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint
Medium
CVE-2026-48925
Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability
Medium
CVE-2026-48924
Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
Medium
CVE-2026-48923
Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation
Medium
CVE-2026-48545
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.