Medium
CVE-2026-4394
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-4406
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
High
Exploited in attacks
CVE-2026-34197
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Medium
CVE-2026-33227
Apache ActiveMQ: Improper validation and restriction of a classpath path name
Critical
CVE-2026-1114
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
Medium
CVE-2026-4065
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
Medium
CVE-2026-1839
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
Medium
CVE-2026-39434
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.26 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-3396
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
Medium
CVE-2026-34899
LTL Freight Quotes – Worldwide Express Edition <= 5.2.1 - Missing Authorization
High
CVE-2026-34894
Integrio Core < 1.2.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-1672
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
Medium
CVE-2026-4654
Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
High
CVE-2026-34893
Thegov Core < 2.0.23 - Unauthenticated Local File Inclusion
Medium
CVE-2026-2509
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
Medium
CVE-2026-39433
WPAMS - Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Medium
CVE-2026-34898
Event Tickets Manager for WooCommerce <= 1.5.3 - Missing Authorization
Medium
CVE-2026-34896
Under Construction, Coming Soon & Maintenance Mode <= 2.1.1 - Cross-Site Request Forgery
Medium
CVE-2026-34904
Simple Social Media Share Buttons – Social Sharing for Everyone <= 6.2.0 - Cross-Site Request Forgery
High
CVE-2026-34902
Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-34895
Softlab Core < 1.2.11 - Unauthenticated Local File Inclusion
Critical
CVE-2026-34901
iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-1900
Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change
Medium
CVE-2026-34903
Ocean Extra <= 2.5.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.