High
CVE-2026-2359
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-39705
MIPL WC Multisite Sync <= 1.4.4 - Missing Authorization
Medium
CVE-2026-32431
Astra Bulk Edit <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39707
Accept PayPal Payments using Contact Form 7 <= 4.0.5 - Missing Authorization
Medium
CVE-2026-39708
UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32427
VW Education Lite <= 2.2.0 - Missing Authorization
Medium
CVE-2026-39700
WowOptin <= 1.4.37 - Missing Authorization
Medium
CVE-2026-32429
Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32430
PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-40729
3D viewer – Embed 3D Models <= 1.8.5 - Missing Authorization
Medium
CVE-2026-39704
Precious Metals Automated Product Pricing – Pro <= 4.1.2 - Missing Authorization
Medium
CVE-2026-39703
WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39702
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32428
Popup Like box <= 3.7.7 - Missing Authorization
Medium
CVE-2026-39706
Make My Trivia <= 1.1.0 - Missing Authorization
Medium
CVE-2026-39701
ShopWP <= 5.2.4 - Missing Authorization
High
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
Medium
CVE-2026-28338
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
High
CVE-2026-2880
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
Low
CVE-2026-82259
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Medium
CVE-2026-18401
jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
Medium
CVE-2026-32425
Payment Gateway Pix For GiveWP <= 2.2.3 - Missing Authorization
High
CVE-2026-32426
Medilazar Core < 1.4.7 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.