Critical
CVE-2026-33439
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-3513
TableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Critical
CVE-2026-4003
Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action
High
CVE-2026-35554
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Medium
CVE-2026-3646
LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2026-4299
MainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API
Medium
CVE-2026-4341
Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter
Medium
CVE-2026-4333
LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
Low
CVE-2026-4292
Django vulnerable to privilege abuse in ModelAdmin.list_editable
Low
CVE-2026-4277
Django vulnerable to privilege abuse in GenericInlineModelAdmin
High
CVE-2026-3902
Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
High
CVE-2026-35463
pyLoad: Improper Neutralization of Special Elements used in an OS Command
Medium
CVE-2026-4785
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2026-33034
Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
Medium
CVE-2026-33033
Django has potential DoS via MultiPartParser through crafted multipart uploads
Medium
CVE-2026-4379
LightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute
Medium
CVE-2026-2988
Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
Medium
CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Medium
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Medium
CVE-2025-14732
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
High
CVE-2026-3499
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
Critical
CVE-2026-3296
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
Medium
CVE-2026-4401
Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
Medium
CVE-2026-2263
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.