Medium
CVE-2026-9233
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-11364
Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions
Medium
CVE-2026-11773
Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
Medium
CVE-2026-11987
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Medium
CVE-2026-11783
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Medium
CVE-2026-12399
Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
Medium
CVE-2026-53463
ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
Medium
CVE-2026-11597
Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-12471
Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
Medium
CVE-2026-13295
Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
High
CVE-2026-46623
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
High
CVE-2026-46619
OpenAM Authentication Bypass via MSISDN LDAP Injection
Medium
CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
Unrated
pysec-2026-236
Malicious code in pyphetools (PyPI)
Medium
CVE-2026-53462
ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails
High
CVE-2026-47214
Docling: Unsafe URI and Path Handling in HTML Backend
Medium
CVE-2026-44018
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Critical
CVE-2026-12415
Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
Medium
CVE-2026-53914
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
Unrated
CVE-2026-13244
drupal/tealiumiq - SA-CONTRIB-2026-064
Unrated
pysec-2026-235
Malicious code in ppkt2synergy (PyPI)
Unrated
pysec-2026-234
Malicious code in phenopacket-store-toolkit (PyPI)
Medium
CVE-2026-13333
Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
Medium
CVE-2026-13335
CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.