High
CVE-2026-40993
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-41697
Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference
Medium
CVE-2026-41701
Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue
Medium
CVE-2026-41714
Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean
Medium
CVE-2026-41696
Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods
Low
CVE-2026-41694
Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads
Medium
CVE-2026-41008
Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter
High
CVE-2026-41717
Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection
High
CVE-2026-40988
Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)
Medium
CVE-2026-40991
Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference
Medium
CVE-2026-52695
ABC Crypto Checkout <= 1.8.2 - Unauthenticated Information Exposure
Medium
CVE-2026-10750
Royal MCP <= 1.4.25 - Missing Authorization to Unauthenticated MCP Tool Use
Medium
CVE-2026-52699
VikRentCar Car Rental Management System <= 1.4.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-52700
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-52696
JetBlog <= 2.4.8 - Unauthenticated Information Exposure
Medium
CVE-2026-52694
Digital Signature Add-on for WooCommerce <= 2.0 - Unauthenticated Information Exposure
Medium
CVE-2026-52698
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-52697
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-11568
Product Configurator for WooCommerce <= 1.7.2 - Unauthenticated Private/Draft Product Data Disclosure
Medium
CVE-2026-11883
WebAuthn Provider for Two Factor <= 2.5.5 - Two-Factor Authentication Bypass
High
CVE-2026-11570
User Submitted Posts <= 20260607 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-60218
PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-49043
WP Migrate Lite – Migration Made Easy <= 2.7.8 - Cross-Site Request Forgery
High
CVE-2026-11794
Advanced Form Integration <= 2.1.0 - Unauthenticated Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.