High
CVE-2026-65477
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-65496
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2026-65501
Shiptastic for WooCommerce <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-27392
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Medium
CVE-2026-25405
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-65506
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization
Medium
CVE-2026-59543
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-65475
Modula Image Gallery – Photo Grid & Video Gallery 2.14.25-2.14.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13146
Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-16221
fast-uri vulnerable to host confusion via literal backslash authority delimiter
High
ghsa-f88m-g3jw-g9cj
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
High
CVE-2026-73569
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Medium
CVE-2026-73565
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Medium
CVE-2026-59889
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
Medium
CVE-2026-73651
TypeORM: migration:generate template-literal code injection
High
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Medium
CVE-2026-47143
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds
Medium
CVE-2026-15787
Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
High
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes atta
High
CVE-2026-73650
SVGO removeScripts plugin leaves some executable scripts intact
Low
CVE-2026-66010
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Medium
ghsa-mhm7-754m-9p8w
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
Critical
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
Critical
CVE-2026-59891
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.