Medium
CVE-2026-105079
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-105260
Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 - Cross-Site Request Forgery
Medium
CVE-2026-86826
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Unauthenticated Information Exposure
High
CVE-2026-103309
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66479
WPComplete <= 2.9.5.6 - Cross-Site Request Forgery
Medium
CVE-2026-94244
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Missing Authorization
Medium
CVE-2026-103070
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-104645
Image Photo Gallery Final Tiles Grid < 3.6.14 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-106596
Visual Composer Website Builder <= 45.16.3 - Missing Authorization
Medium
CVE-2026-106603
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-103072
VillaTheme Core <= 1.0.5 - Missing Authorization
Medium
CVE-2026-105078
WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-103692
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Information Exposure
Medium
CVE-2026-62127
WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-61439
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
High
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
High
CVE-2026-105643
Ghost: Stored XSS via Embed Card Previews
Medium
CVE-2026-105644
Ghost : Stored XSS via SVG Files in Content Imports
Medium
CVE-2026-105645
Ghost: Regular Expression Denial of Service in External Media Inliner
Medium
CVE-2026-105646
Ghost: Regular Expression Denial of Service in Content Import
Medium
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
Medium
CVE-2026-105748
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Critical
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.