Medium
CVE-2026-86786
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-89289
Fast Courier <= 5.2.3 - Missing Authorization
High
CVE-2026-94166
UpSolution Core <= 8.44 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-95591
VikBooking Hotel Booking Engine & PMS <= 1.8.14 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-103337
SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more <= 1.23.2 - Missing Authorization
High
CVE-2026-94641
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-96331
Ajax Search Pro <= 4.29.1 - Unauthenticated SQL Injection
Medium
CVE-2026-96671
Featured Image from URL (FIFU) <= 6.0.7 - Cross-Site Request Forgery
High
CVE-2026-95596
ShopBuilder – WooCommerce Builder For Elementor <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-96761
Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-95609
Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-96329
tagDiv Opt-In Builder <= 1.7.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-96328
JNews - Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
High
CVE-2026-94632
BlockStrap Page Builder – Bootstrap Blocks <= 0.1.58 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-95599
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 6.0.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-94270
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass
Medium
CVE-2026-94568
Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-94661
JetBlog <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-95598
Search in Place <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
High
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
High
CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
High
CVE-2026-71416
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Critical
CVE-2026-10032
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.