Medium
CVE-2026-11358
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-11360
Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter
High
CVE-2026-9860
Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action
Medium
CVE-2026-11357
Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
Medium
CVE-2026-11776
Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
Medium
CVE-2026-11777
Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter
Medium
CVE-2026-10029
Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints
Medium
CVE-2026-9199
Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter
High
CVE-2026-12407
E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter
Medium
CVE-2026-10023
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Medium
CVE-2026-53931
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
Medium
CVE-2026-53930
NocoDB: Server-Side Request Forgery via Base Migration URL
Medium
CVE-2026-53929
NocoDB: Stored Cross-Site Scripting via Secure Attachment
Medium
CVE-2026-53928
NocoDB: Refresh Tokens Persist Through Password Recovery
Medium
CVE-2026-53927
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
Medium
CVE-2026-53765
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Medium
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Medium
CVE-2026-54325
Pi Agent: Pi loads project-local extensions without approval
High
CVE-2026-54328
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Low
CVE-2026-54327
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
Medium
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
High
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
Critical
CVE-2026-50203
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
Medium
CVE-2026-48776
LangGraph SDK has unsafe URL path construction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.