Low
CVE-2026-56394
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
High
CVE-2026-49485
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Critical
CVE-2026-14894
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
High
ghsa-52vm-mxx8-f227
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
Medium
ghsa-q6gh-6v2r-hjv3
Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers
High
ghsa-387m-935m-c4vw
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Unrated
868
Breezingforms - Other
High
CVE-2026-12597
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback
High
CVE-2026-12595
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
High
CVE-2026-12598
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback
High
CVE-2026-13492
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
Medium
CVE-2026-57807
WordPress Single Sign-On (SSO) - Multisite Premium <= 38.5.8 - Missing Authorization
High
CVE-2026-57738
777 <= 1.13.0 - Unauthenticated PHP Object Injection
High
CVE-2026-57715
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57810
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.4 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-59515
AI Copilot – Content Generator <= 1.5.4 - Unauthenticated SQL Injection
High
CVE-2026-59514
BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection
High
CVE-2026-59518
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-57710
WoowBot Pro Max <= 14.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-59523
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.11 - Missing Authorization
Critical
CVE-2026-57811
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Remote Code Execution
Critical
CVE-2026-57813
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-57812
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.4 - Missing Authorization
High
CVE-2026-57691
Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.