Medium
CVE-2026-49771
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-49767
wpForo Forum <= 3.1.0 - Missing Authorization
High
CVE-2026-49763
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection
High
CVE-2026-49768
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-49764
RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization
High
CVE-2026-49106
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 - Unauthenticated PHP Object Injection
High
CVE-2026-49108
Moderno < 1.43 - Unauthenticated PHP Object Injection
Medium
CVE-2025-10268
Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Directory Traversal to Unauthenticated Folder Content Disclosure
High
CVE-2026-49778
WPFunnels Pro <= 2.9.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-52793
Froxlor's API Authentication bypasses 2FA Authentication
High
CVE-2026-49143
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
High
CVE-2026-49144
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
High
CVE-2026-7888
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Critical
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
High
CVE-2026-42342
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
High
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
High
CVE-2026-41234
Froxlor: BIND Zone File Injection via TXT Record Content
Medium
CVE-2026-40181
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
High
CVE-2026-33245
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
Medium
CVE-2026-33244
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
Medium
CVE-2022-31114
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
High
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.