Medium
CVE-2026-10827
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-15208
RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-12696
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-57699
Slider Pro <= 4.8.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-57703
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.6.10.1 - Missing Authorization
Medium
CVE-2026-11882
Builderall for WordPress <= 3.0.1 - Missing Authorization to Unauthenticated OAuth Update
Medium
CVE-2026-13329
WC Buckaroo BPE Gateway <= 4.8.0 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Order Refund
Medium
CVE-2026-15939
Simple Restrict < 1.2.9 - Authenticated (Contributor+) Information Exposure
Critical
CVE-2026-14561
Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation
Medium
CVE-2026-15385
RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-14315
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels < 2.2.1 - Unauthenticated Conversion Forge
Medium
CVE-2026-57701
Real Estate Manager Pro <= 12.8.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-10524
CoCart <= 4.8.0 - Unauthenticated Price Manipulation
Medium
CVE-2026-15147
Five Star Restaurant Reservations <= 2.7.22 - Unauthenticated Insecure Direct Object Reference to Payment Bypass
High
CVE-2026-57696
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion
Unrated
CVE-2023-54366
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database ac
Unrated
876
chronoforms
Unrated
873
dpcalendar - Other
High
CVE-2026-55177
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
Medium
CVE-2026-54570
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
Medium
ghsa-mfr4-mq8w-vmg6
PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
Medium
CVE-2026-53496
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
High
CVE-2026-53597
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
High
CVE-2026-53598
Prompty: Arbitrary file read via file reference expansion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.