High
CVE-2026-61947
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-61945
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-14862
Support Genix Lite <= 1.4.47 - Missing Authorization
Medium
CVE-2026-61946
Easy Appointments <= 3.12.27 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-57428
Sprout Clients – CRM and Lead Management <= 3.2.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57427
Download Monitor - WPForms Lock <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-61950
TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection
Medium
CVE-2026-61943
Premium Packages – Sell Digital Products Securely <= 6.2.0 - Missing Authorization
Medium
CVE-2026-12697
wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion
High
CVE-2026-13609
Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57425
Autopay dla WooCommerce <= 2.2.27 - Missing Authorization
High
CVE-2026-61944
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting
Medium
ghsa-xg43-5579-qw6v
adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files
High
CVE-2026-54504
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
CVE-2026-50273
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-50272
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-50270
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-105315
django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization
Medium
CVE-2026-54490
websocket-driver: Resource limit bypass via message compression
Critical
CVE-2026-54466
websocket-driver: Message corruption via abuse of protocol length headers
High
ghsa-62gx-5q78-wrvx
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
High
CVE-2026-13741
Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter
High
CVE-2026-15005
Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.