High
CVE-2026-3718
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Critical
CVE-2026-6271
Career Section <= 1.7 - Unauthenticated Arbitrary File Upload
High
CVE-2026-3892
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
Medium
CVE-2026-5365
LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
Unrated
CVE-2026-8495
drupal/date_ical - SA-CONTRIB-2026-037
Unrated
CVE-2026-8493
drupal/colorbox_inline - SA-CONTRIB-2026-036
Unrated
CVE-2026-8492
drupal/gtranslate - SA-CONTRIB-2026-035
Unrated
CVE-2026-8491
drupal/node_view_permissions - SA-CONTRIB-2026-034
Medium
CVE-2026-6417
GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'
Medium
CVE-2025-15345
MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter
Medium
CVE-2026-3829
WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering
High
CVE-2026-5396
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
Critical
CVE-2026-8181
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
High
CVE-2026-44432
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
High
CVE-2026-44431
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
High
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Medium
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
Critical
CVE-2026-45083
Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy
High
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
High
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
High
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Medium
CVE-2026-7648
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
Medium
CVE-2026-5361
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.