Medium
CVE-2026-27039
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-24976
Organici Library <= 2.1.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-39496
YayMail <= 4.3.3 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-32461
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.7 - Missing Authorization
Medium
CVE-2026-40740
Tutor LMS <= 3.9.7 - Missing Authorization
Medium
CVE-2026-2233
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
High
CVE-2026-1947
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
Medium
CVE-2026-1883
Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion
Medium
CVE-2026-1870
Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure
Medium
CVE-2026-40734
Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39464
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.19.8 - Authenticated (Editor+) Server-Side Request Forgery
Medium
CVE-2026-32460
Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32459
UpsellWP – WooCommerce Upsell and Related Products Offers <= 2.2.4 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-40737
COMPE <= 1.1.4 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-60012
Apache Livy: Restrict file access
Medium
CVE-2025-66249
Apache Livy: Unauthorized directory access
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
High
CVE-2026-32933
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
High
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
Medium
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
High
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.