Medium
CVE-2026-107380
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 77
Reset filters
Medium
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
Medium
CVE-2026-88974
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
High
CVE-2026-45293
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
Medium
CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitization
High
CVE-2026-107376
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
Medium
CVE-2026-40308
My Calendar < 3.7.7 - Unauthenticated Denial of Service
High
ghsa-vfpx-q664-h93m
Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption
High
CVE-2026-34236
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
High
CVE-2026-30940
baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API
High
CVE-2026-4267
Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
Medium
CVE-2026-1217
Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
High
CVE-2025-14675
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Medium
ghsa-vvg7-8rmq-92g7
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency
Medium
CVE-2025-68129
Auth0-PHP SDK has Improper Audience Validation
Low
CVE-2025-58769
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
Medium
CVE-2025-8678
WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery
Critical
ghsa-862m-5253-832r
Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data
Critical
CVE-2025-48951
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
ghsa-2f4r-34m4-3w8q
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Critical
CVE-2025-47275
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
Medium
CVE-2024-11847
WP SVG Upload <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Medium
CVE-2024-11718
tarteaucitron.js for WordPress < 0.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.