Critical
CVE-2026-25056
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
High
CVE-2026-25054
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
Medium
CVE-2026-1319
Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field
Medium
CVE-2026-25475
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
Medium
CVE-2026-1268
Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field
Medium
CVE-2026-0867
Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Critical
CVE-2026-25053
n8n has OS Command Injection in Git Node
Medium
CVE-2026-1246
ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
Critical
CVE-2026-25052
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
High
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
Critical
CVE-2026-25049
n8n Has Expression Escape Vulnerability Leading to RCE
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
Critical
CVE-2026-21893
n8n Vulnerable to Command Injection in Community Package Installation
High
CVE-2025-61917
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
Unrated
CVE-2026-1917
drupal/login_disable - SA-CONTRIB-2026-008
Medium
CVE-2026-1622
Neo4j Enterprise and Community vulnerable to a potential information disclosure
High
CVE-2025-13192
Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
Medium
CVE-2025-68834
Sync Master Sheet – Product Sync with Google Sheet for WooCommerce <= 1.1.3 - Missing Authorization
Medium
CVE-2025-68024
Addonify – WooCommerce Wishlist <= 2.0.15 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2025-67982
Urna <= 2.5.12 - Unauthenticated Local File Inclusion
High
CVE-2025-68841
TopperPack – Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68022
Plugin BlueX for WooCommerce <= 3.1.4 - Missing Authorization
Medium
CVE-2025-68023
Addonify – Compare Products For WooCommerce <= 1.1.17 - Missing Authorization to Unauthenticated Settings Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.