Low
CVE-2026-41000
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-40998
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Medium
CVE-2026-40996
Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Medium
CVE-2026-40997
Spring Web Services: SOAP security faults leak Spring Security account state
Medium
CVE-2026-40986
Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Medium
CVE-2026-40992
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
High
CVE-2026-40987
Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
Medium
CVE-2026-40985
Spring Web Flow has Data Binding Vulnerability with Unified EL Parser
High
CVE-2026-10142
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by
High
CVE-2026-10143
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by suppl
High
CVE-2026-6379
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection
Medium
CVE-2026-9067
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
Critical
CVE-2026-11976
MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor
High
CVE-2026-3326
XStore < 9.7.3 - Unauthenticated SQL Injection
High
CVE-2026-5776
Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-1631
Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 - Missing Authorization
Medium
CVE-2026-11781
Adminify <= 4.2.9 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-7385
Decent Comments < 3.0.2 - Unauthenticated Information Exopsure
Medium
CVE-2026-6268
EventPress < 22.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-8981
Custom Block Builder – Lazy Blocks < 4.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2026-8071
CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15609
Fortis for WooCommerce < 1.3.1 - Unauthenticated Information Exposure
Medium
CVE-2026-11965
User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-9060
Store Locator WordPress < 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.