Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
drupal/webform - SA-CONTRIB-2026-165
drupal/webform - SA-CONTRIB-2026-164
drupal/webform - SA-CONTRIB-2026-163
drupal/webform - SA-CONTRIB-2026-162
drupal/webform - SA-CONTRIB-2026-161
drupal/webform - SA-CONTRIB-2026-160
drupal/webform - SA-CONTRIB-2026-159
drupal/webform - SA-CONTRIB-2026-158
drupal/webform - SA-CONTRIB-2026-155
drupal/webform - SA-CONTRIB-2026-154
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.50.1 - Cross-Site Request Forgery
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting
Solspace Freeform: Limited Twig template injection via submitted field values
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Podcast Importer SecondLine <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate FAQ Accordion Plugin <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Core Web Vitals & PageSpeed Booster <= 1.0.31 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.