Medium
CVE-2026-18057
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-16737
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
Medium
CVE-2026-13171
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation
Medium
CVE-2026-66453
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.30.26 - Missing Authorization
Medium
CVE-2026-61985
Car Rental Manager – Online Vehicle Booking System <= 1.3.7 - Missing Authorization
Medium
CVE-2026-14211
Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure
Critical
CVE-2026-14364
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
Critical
CVE-2026-14365
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
Medium
CVE-2026-17020
Salon Booking System – Free Version < 10.31.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure
Medium
CVE-2026-15237
Hotel Booking Lite <= 6.2.2 - Missing Authorization
Medium
CVE-2026-17021
Salon Booking System – Free Version <= 10.30.33 - Missing Authorization
Medium
CVE-2026-17022
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Booking Information Disclosure
Medium
CVE-2026-15238
Hotel Booking Lite <= 6.2.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Customer Data Modification
Medium
CVE-2026-15229
Pinpoint Booking System <= 2.9.9.7.1 - Missing Authorization to Unauthenticated Arbitrary Booking Price Manipulation
Medium
CVE-2026-13170
Eventin <= 4.1.19 - Authenticated (Editor+) Local File Inclusion
Medium
CVE-2026-17023
Salon Booking System – Free Version < 10.31.3 - Missing Authorization to Unauthenticated Google Calendar Connection Hijack
Medium
CVE-2026-5391
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-66425
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization
Medium
CVE-2026-66451
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization
Medium
CVE-2026-12500
WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.8.2 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2026-16143
VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15918
VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
Medium
CVE-2026-13143
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-13178
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.