High
CVE-2026-25547
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2026-0743
WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter
High
CVE-2026-24887
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
Medium
CVE-2026-0572
WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
Medium
CVE-2025-15482
Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-15508
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
High
CVE-2026-24053
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes
Medium
CVE-2025-15507
Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification
Medium
CVE-2025-14461
Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid
High
CVE-2025-15285
SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification
Medium
CVE-2026-1370
SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
Medium
CVE-2026-0681
Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Medium
CVE-2026-25543
HtmlSanitizer has a bypass via template tag
High
CVE-2026-24052
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
High
CVE-2025-69215
OpenSTAManager has an SQL Injection in the Stampe Module
High
CVE-2025-69213
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
Medium
CVE-2026-1664
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
High
CVE-2025-69983
FUXA allows Remote Code Execution (RCE) via the project import functionality.
High
CVE-2025-69981
FUXA contains an Unrestricted File Upload vulnerability
High
CVE-2025-69970
FUXA contains an insecure default configuration vulnerability
Medium
CVE-2026-23795
Apache Syncope: Console XXE on Keymaster parameters
Medium
CVE-2026-23794
Apache Syncope: Reflected XSS on Enduser Login
High
CVE-2026-25514
FacturaScripts has SQL Injection in Autocomplete Actions
High
CVE-2026-25513
FacturaScripts has SQL Injection in API ORDER BY Clause
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.