Medium
CVE-2026-49056
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-48966
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-48867
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48965
Backup, Restore and Migrate your sites with XCloner <= 4.8.6 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-48967
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-35212
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable bod
Medium
CVE-2026-47265
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
Medium
CVE-2026-34993
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
Medium
CVE-2026-46718
Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes
Medium
CVE-2026-9732
EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-7421
Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
High
CVE-2026-3514
Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'
Medium
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Critical
CVE-2026-5076
ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
Medium
CVE-2026-5074
ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
High
CVE-2026-5073
ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter
High
CVE-2026-1829
Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-10291
Claw Orchestrator has inefficient regular expression complexity via validateRegex()
Medium
CVE-2026-48873
Montonio for WooCommerce <= 10.1.2 - Missing Authorization
Medium
CVE-2026-48868
Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-48874
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-48889
Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-27351
Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 - Missing Authorization
High
CVE-2026-48885
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.