Medium
CVE-2026-82213
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-88802
Mobile Events Manager <= 1.4.8.3 & MDJM Event Management < 1.7.8.5 - Missing Authorization
Medium
CVE-2026-62102
Gato GraphQL <= 19.2.3 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-86782
Visualizer – Tables & Charts Manager with Built-in AI Generator 4.0.0 - 4.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-88764
Simple Membership < 4.7.8 - Missing Authorization
Medium
CVE-2026-78361
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization
Medium
CVE-2026-62113
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated <= 4.10.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-10148
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
High
CVE-2026-59965
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
High
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
Medium
CVE-2024-12145
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
Critical
CVE-2026-88062
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
Medium
CVE-2026-86073
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
Medium
CVE-2026-86074
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
Medium
CVE-2026-86995
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
Medium
CVE-2026-86085
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
Medium
CVE-2026-86993
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
Medium
CVE-2026-86084
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
Medium
CVE-2026-86080
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
Medium
CVE-2026-86079
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
Medium
CVE-2026-86078
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
Medium
CVE-2026-86994
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
High
CVE-2026-17037
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
High
CVE-2026-86083
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.