Medium
CVE-2026-5486
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-44720
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
Low
CVE-2026-45028
Astro: Server island encrypted parameters vulnerable to cross-component replay
Critical
CVE-2026-44672
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
High
CVE-2026-4029
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export
Medium
CVE-2026-42671
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization
Medium
CVE-2026-45436
WPBakery Page Builder <= 8.7.2 - Missing Authorization
High
CVE-2026-23970
Redirection for Contact Form 7 <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-7525
My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
High
CVE-2026-4030
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
High
CVE-2026-4031
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception
Medium
CVE-2026-5243
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
High
CVE-2026-42668
Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token
Medium
CVE-2026-44652
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
Medium
CVE-2026-44651
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
Critical
CVE-2026-44650
SillyTavern has a Path Traversal issue
Critical
CVE-2026-44649
SillyTavern has Authentication Bypass via SSO Header Injection
High
CVE-2026-44648
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
High
CVE-2026-4798
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Medium
CVE-2026-4782
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Critical
CVE-2026-33117
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
Critical
CVE-2026-31236
llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
Critical
CVE-2026-31235
imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.