Medium
CVE-2026-0635
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-14464
PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials
Medium
CVE-2025-14854
WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification
Medium
CVE-2026-0694
SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Medium
CVE-2025-14379
Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-15486
Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-22704
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
Medium
CVE-2025-68949
n8n: Webhook Node IP Whitelist Bypass via Partial String Matching
High
CVE-2025-68931
Jervis's AES CBC Mode is Without Authentication
Medium
CVE-2025-68925
Jervis Has a JWT Algorithm Confusion Vulnerability
High
CVE-2025-68704
Jervis Has Weak Random for Timing Attack Mitigation
High
CVE-2025-68703
Jervis's Salt for PBKDF2 derived from password
High
CVE-2025-68702
Jervis Has a SHA-256 Hex String Padding Bug
High
CVE-2025-68701
Jervis has Deterministic AES IV Derivation from Passphrase
High
CVE-2025-68698
Jervis Has a RSA PKCS#1 Padding Vulnerability
Medium
CVE-2026-24607
Travel Monster <= 1.3.3 - Missing Authorization
High
CVE-2025-68913
Miion <= 1.2.7 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-68905
JNews - Pay Writer <= 11.0.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-68903
Anona <= 8.0 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2025-69097
WPLMS <= 1.9.9.5.4 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-68912
HDForms <= 1.6.1 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-68899
Vivagh <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-27050
RealPress – Real Estate Plugin <= 1.1.0 - Cross-Site Request Forgery
Critical
CVE-2025-68907
Hostme v2 <= 7.0 - Unauthenticated Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.