Medium
CVE-2026-1369
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2026-39602
Order Tracking <= 3.4.4 - Missing Authorization
Medium
CVE-2020-37044
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicio
High
CVE-2020-37041
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with p
High
CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Medium
CVE-2026-25129
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
Critical
CVE-2026-25141
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Critical
CVE-2026-25130
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
Low
CVE-2026-25050
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Medium
CVE-2025-15525
Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
Medium
CVE-2026-1431
Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
High
CVE-2024-4027
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
Medium
CVE-2026-24687
Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac
Medium
CVE-2025-15510
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-25394
Fitness FSE <= 1.0.6 - Missing Authorization
Medium
CVE-2026-25020
WP Sync for Notion <= 1.7.0 - Missing Authorization
Medium
CVE-2026-25391
WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 - Missing Authorization
Medium
CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
Medium
CVE-2026-25021
Mizan Demo Importer <= 0.1.3 - Missing Authorization
Medium
CVE-2026-25399
Serious Slider <= 1.2.7 - Missing Authorization
High
CVE-2025-14554
Sell BTC - Cryptocurrency Selling Calculator <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action
Medium
CVE-2026-25395
Business Roy <= 1.1.4 - Missing Authorization
Medium
CVE-2026-1165
Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.