Medium
CVE-2026-30974
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
High
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
High
CVE-2026-3496
JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter
Medium
CVE-2026-3534
Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
High
CVE-2026-3222
WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter
Medium
CVE-2026-2707
weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
Medium
CVE-2026-2358
WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
High
CVE-2026-2413
Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
High
CVE-2025-13067
Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
High
CVE-2026-3453
ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
Medium
CVE-2026-1781
MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
Medium
CVE-2025-12473
RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
Medium
CVE-2026-2324
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Medium
CVE-2026-2569
Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels
Medium
CVE-2026-30964
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
Medium
CVE-2026-30959
OneUptime has WhatsApp Resend Verification Authorization Bypass
Critical
CVE-2026-30957
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
Critical
CVE-2026-30956
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
High
CVE-2026-30952
liquidjs has a path traversal fallback vulnerability
Medium
CVE-2026-3089
Actual Sync Server has an Authenticated Path Traversal
High
CVE-2026-30939
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
Medium
CVE-2026-30938
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.