High
CVE-2026-45048
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Medium
CVE-2026-55423
Langflow: Logout button does not clear session
High
Exploited in attacks
CVE-2026-55255
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
Critical
CVE-2026-55450
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
High
CVE-2026-55446
Langflow: Unauthenticated DoS through multipart form boundary file upload
Critical
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
Medium
CVE-2026-48520
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
High
CVE-2026-33760
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Medium
CVE-2026-11370
WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
High
CVE-2026-9643
WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
Medium
CVE-2026-9620
WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
High
CVE-2026-4297
Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method
Medium
CVE-2026-8896
MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-12100
URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
High
CVE-2026-12095
Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter
Medium
CVE-2026-12094
Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter
Medium
CVE-2026-11997
Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-10552
Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter
Medium
CVE-2026-9724
MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-9721
Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-8865
Avalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-9616
Generate Security.txt <= 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action
Medium
CVE-2026-9619
Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action
Medium
CVE-2026-9612
WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.