Medium
CVE-2026-1881
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-9065
SureCart <= 4.2.0 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-42383
YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-27405
Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization
Medium
CVE-2026-48094
ShareOpenly < 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-27424
Image Photo Gallery Final Tiles Grid <= 3.6.11 - Missing Authorization
High
CVE-2026-42756
QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly <= 3.2.7 - Authenticated (Contributor+) Arbitrary File Deletion
Critical
CVE-2026-5118
Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
Medium
CVE-2026-45443
PDF for Elementor Forms + Drag And Drop Template Builder <= 5.5.1 - Missing Authorization
Medium
CVE-2026-9059
Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-24573
Visualizer: Tables and Charts Manager for WordPress < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-45444
Gift Cards For WooCommerce Pro <= 4.2.6 - Unauthenticated Arbitrary File Upload
High
CVE-2026-42683
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24637
PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-42728
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48093
Code Embed <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-49466
Draft List < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_t
Medium
CVE-2026-6728
Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
High
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Critical
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
High
ghsa-7hgr-7h44-33w2
CamoFox MCP: Unauthenticated HTTP MCP browser-control surface
High
CVE-2026-46372
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.