Medium
CVE-2026-12988
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,528
High
CVE-2026-12242
AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute
High
CVE-2026-12511
AI Engine <= 3.5.4 - Authenticated (Editor+) Arbitrary File Write
High
CVE-2026-56031
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-12583
Newsletters <= 4.14 - Unauthenticated PHP Object Injection
High
CVE-2026-56036
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.6 - Unauthenticated SQL Injection
Critical
CVE-2026-56033
Dokan Pro <= 5.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2026-56035
BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection <= 5.0.3 - Missing Authorization
Critical
CVE-2026-56030
Paytium: Mollie payment forms & donations <= 5.0.2 - Unauthenticated Privilege Escalation
Medium
CVE-2026-27366
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 - Missing Authorization
High
CVE-2026-7761
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
Critical
CVE-2026-13142
Social Login, Passkeys, Magic Link & Email OTP < 1.4.1 - Unauthenticated Account Takeover via OTP Brute Force
Medium
CVE-2026-56026
utm.codes <= 1.9.0 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-56037
Themify Popup <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-11563
Word Count and Social Shares <= 1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-56032
BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-56027
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload
Medium
CVE-2026-56029
CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization
Medium
CVE-2026-11567
SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass
Medium
CVE-2025-15665
BEAF <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-56034
Library Management System <= 3.5.7 - Unauthenticated SQL Injection
Medium
CVE-2026-50179
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
High
CVE-2026-54353
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
Critical
CVE-2026-54352
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.