Low
CVE-2026-53848
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-46580
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
High
CVE-2026-44691
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
High
CVE-2026-44688
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Medium
CVE-2026-22551
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
Medium
CVE-2026-3640
STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
Medium
CVE-2026-6798
2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter
High
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Critical
CVE-2026-58399
@acastellon/auth: Authentication bypass via spoofable headers in validateToken()
Medium
CVE-2026-11752
Armeria: External Control of File Name or Path in xDS SDS DataSource
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Medium
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
Critical
CVE-2026-7515
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
Medium
CVE-2026-8118
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
Critical
CVE-2026-8713
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Medium
CVE-2026-1856
Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Medium
CVE-2026-7547
Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
Medium
CVE-2026-10034
WP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)
Medium
CVE-2026-9013
Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API
Medium
CVE-2026-11989
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
Medium
CVE-2026-4328
Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
Medium
CVE-2026-12430
Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
Medium
CVE-2026-12157
BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.