Medium
CVE-2026-54561
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
ghsa-cvpc-hccg-wmw4
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Medium
CVE-2026-54546
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
High
CVE-2026-11400
AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Medium
ghsa-8rqh-vxpr-x77p
plone.restapi: Stored XSS by spoofing mime type
Medium
CVE-2026-9734
W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-15244
HUSKY - Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion
Medium
CVE-2026-15246
RealHomes Memberships <= 3.0.0 - Authenticated (Subscriber+) Payment Bypass
Critical
CVE-2026-61951
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation
High
Exploited in attacks
CVE-2026-60137
WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter
High
CVE-2026-15368
Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover
High
CVE-2026-13158
Everest Toolkit <= 1.2.3 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2026-13157
Theme Demo Import <= 1.1.3 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-14309
Chat On Desk <= 1.0.8 - Unauthenticated Two-Factor Authentication Bypass to Password Reset
Critical
Exploited in attacks
CVE-2026-63030
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
High
CVE-2026-63397
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema
High
CVE-2026-67342
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
High
CVE-2026-67341
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
High
CVE-2026-67340
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
High
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
Critical
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
High
CVE-2026-55578
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
High
CVE-2026-54076
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
High
CVE-2026-54077
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.