Medium
CVE-2025-62127
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-25468
Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure
Medium
CVE-2025-68604
WPGraphQL <= 2.5.3 - Cross-Site Request Forgery
High
CVE-2026-40798
wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection
Medium
CVE-2026-27416
PDF Poster – Display PDF Files with Custom Viewer <= 2.4.1 - Missing Authorization
Medium
CVE-2026-27415
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery
High
CVE-2026-42773
eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection
Medium
CVE-2026-27421
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-68060
Team Members – Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-27329
YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-68049
bunny.net – WordPress CDN Plugin <= 2.3.6 - Missing Authorization
Medium
CVE-2026-7862
Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization to Unauthenticated Arbitrary Refund Initiation
Medium
CVE-2026-25436
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization
Medium
CVE-2026-44456
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Medium
CVE-2026-44455
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
ghsa-cqmh-pcgr-q42f
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening
Medium
ghsa-248h-974q-xrc2
axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Medium
ghsa-mph8-9v29-pm42
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Medium
ghsa-7f4h-6264-89fr
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
High
CVE-2026-42577
Netty epoll transport denial of service via RST on half-closed TCP connection
High
CVE-2026-0897
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (D
High
CVE-2026-44375
Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
Medium
CVE-2026-44374
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.