Medium
CVE-2026-15149
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-59517
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57626
MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 - Cross-Site Request Forgery
Medium
CVE-2026-59513
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-61958
License Manager for WooCommerce <= 3.0.17 - Authenticated (Customer+) Arbitrary Content Deletion
Medium
CVE-2026-57808
WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.0 - Authenticated (Subscriber+) Arbitrary Content Deletion
Medium
CVE-2026-57717
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.0.0 - Missing Authorization
Medium
CVE-2026-57769
Grand Photography WordPress <= 5.7.8 - Reflected Cross-Site Scripting
Unrated
879
Phoca Guestbook - Other
Unrated
880
EasyStore Pro - Other
Medium
CVE-2026-67354
Guzzle: URI fragments disclosed in redirect Referer headers
Medium
CVE-2026-67355
Guzzle: Host-only cookie scope is not preserved
Medium
CVE-2026-67353
Guzzle: Unbounded response cookies risk denial of service
Medium
CVE-2026-73423
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Medium
CVE-2026-73424
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Low
CVE-2026-73425
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
Low
CVE-2026-12590
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Low
CVE-2026-59730
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Medium
CVE-2026-59729
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Medium
CVE-2026-59728
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
Low
CVE-2026-59727
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
High
CVE-2026-50651
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
Medium
CVE-2026-50659
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
High
CVE-2026-50525
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.