Medium
CVE-2026-56042
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
High
CVE-2026-56041
Responsive Lightbox & Gallery <= 2.7.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-12512
Quotes Llama <= 3.1.5 - Unauthenticated SQL Injection
High
CVE-2026-56040
Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-56046
ListingPro - WordPress Directory & Listing Theme <= 2.9.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-56052
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.5 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-56071
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11579
Kali Forms <= 2.4.16 - Missing Authorization to Unauthenticated Media File Upload
High
CVE-2026-56038
Frisbii Pay <= 1.8.2 - Authenticated (Contributor+) Privilege Escalation
Medium
CVE-2026-56039
Quick Interest Slider <= 3.1.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-11580
Kali Forms <= 2.4.16 - Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure
High
CVE-2026-54329
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Low
CVE-2026-55542
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Low
CVE-2026-55519
Snipe-IT has Improper Authorization in File Deletion (IDOR)
Medium
CVE-2026-55483
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Medium
CVE-2026-55482
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
Medium
CVE-2026-50550
Snipe-IT has a 2FA reset privilege bypass
Medium
CVE-2026-49976
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Medium
ghsa-w2j7-f3c6-g8cw
Flask-Security has an Open Redirect issue
Medium
CVE-2026-49870
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Medium
CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
High
CVE-2026-48507
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
Medium
CVE-2026-48500
Filament: Unauthenticated temporary file upload on auth pages
Medium
CVE-2026-48493
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.