Medium
CVE-2026-66651
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-73398
Piraeus Bank WooCommerce Payment Gateway 3.2.0 - Missing Authorization
Medium
CVE-2026-66589
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More <= 5.2.30 - Missing Authorization
Medium
CVE-2026-73345
License Manager for WooCommerce <= 3.0.18 - Authenticated (Customer+) SQL Injection
Medium
CVE-2026-73994
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization
Medium
CVE-2026-68565
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66646
WP Tab Widget <= 1.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-73350
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization
High
CVE-2026-73351
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66629
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-68567
EasyTest – Simplify A/B Testing <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66636
Wise Chat <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32472
Online Contact Widget-多合一在线客服插件 <= 1.3.0 - Missing Authorization
High
CVE-2026-32474
Templatiq <= 0.2.5 - Authenticated (Contributor+) Arbitrary File Upload
High
CVE-2026-69148
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Medium
CVE-2026-69146
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
High
CVE-2026-56677
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
High
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
Medium
CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
Medium
CVE-2026-53766
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
High
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
High
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
High
CVE-2026-91987
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
High
CVE-2026-91988
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.