Critical
CVE-2026-76904
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-86197
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Medium
CVE-2026-63466
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Medium
CVE-2026-63004
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
High
CVE-2026-63462
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
Medium
CVE-2026-75027
Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Medium
CVE-2026-76057
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
Medium
CVE-2026-76074
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action
High
CVE-2026-19883
WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
Medium
CVE-2026-32478
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2026-18937
Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution
Medium
CVE-2026-18779
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
Medium
CVE-2026-18778
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-78470
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2026-4703
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
Medium
CVE-2026-19699
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-19417
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
Medium
CVE-2026-18202
JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-14853
WooCommerce Bookings <= 3.8.0 - Missing Authorization
High
CVE-2026-18051
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal
High
CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read
Medium
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
High
CVE-2026-18776
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation
Medium
CVE-2026-77013
爱采集数据采集和发布插件 <= 1.0.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.