Medium
3d59700b-3540-464c-bd27-23bb71f9b082
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-76790
Estatik <= 4.3.4 - Reflected Cross-Site Scripting
Medium
28747e2e-9012-470c-a891-0fe97fd1ddba
WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
High
CVE-2026-93485
WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
Medium
CVE-2026-87831
Checkout Field Manager <= 7.9.6 - Missing Authorization
Medium
CVE-2026-92404
MgoSync 2.1.5 - 2.1.6 - Unauthenticated Information Exposure
Medium
CVE-2026-84091
SUMIT Payment Gateway for WooCommerce <= 3.0.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-58657
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
High
CVE-2026-63671
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
Medium
CVE-2026-61453
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
Medium
CVE-2026-59193
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Medium
CVE-2026-66676
Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 - Missing Authorization
Medium
CVE-2026-73999
Cooked – Recipe Management <= 1.16.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-74000
Simple Membership <= 4.8.2 - Missing Authorization
Medium
CVE-2026-74002
Booking Calendar <= 11.7 - Missing Authorization
Medium
CVE-2026-74017
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
Medium
CVE-2026-74005
Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Cross-Site Request Forgery
Medium
CVE-2026-78294
Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-78295
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery
Medium
CVE-2026-78528
BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 - Missing Authorization
Unrated
drupal-core-2026-013
Drupal core - SA-CORE-2026-013
High
CVE-2026-87935
Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
Critical
CVE-2026-87796
Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
High
CVE-2026-68904
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.