Medium
CVE-2026-49062
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-52692
Affiliates Manager <= 2.9.50 - Unauthenticated Information Exposure
High
CVE-2026-49084
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
Medium
CVE-2026-49070
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.4.0.0 - Missing Authorization
Medium
CVE-2026-49065
Hippoo Mobile App for WooCommerce <= 1.9.5 - Missing Authorization
Medium
CVE-2026-49072
WooCommerce Anti-Fraud <= 7.2.6 - Missing Authorization
High
CVE-2026-49111
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-49073
Booking (Reservation & Appointment) <= 3.0.3 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-3011
Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'
Medium
CVE-2021-47983
Accept Stripe Payments <= 2.0.39 - Authenticated (Admin+) Stored Cross-Site Scripting
Critical
CVE-2024-58348
Background Image Cropper <= 1.2 - Unauthenticated Remote Code Execution
Medium
CVE-2026-10820
ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
Medium
CVE-2026-45409
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
High
CVE-2026-47732
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
Low
CVE-2026-47730
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
High
CVE-2026-24425
Twig: Possible sandbox bypass when using a source policy
Critical
CVE-2026-47744
Shopper: Authorization bypass and RBAC privilege escalation in team settings
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Medium
CVE-2026-47745
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Medium
CVE-2026-47742
Shopper: Missing authorization on Product admin Livewire sub-form components
High
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Critical
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.