Medium
ghsa-qp9x-wp8f-qgjj
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2025-12714
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
High
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Medium
CVE-2026-47718
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Medium
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Medium
CVE-2026-9189
Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Low
CVE-2026-46644
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Medium
CVE-2026-10039
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
Medium
CVE-2026-44394
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
Medium
CVE-2026-43000
OpenStack Keystone has an Incorrect Authorization issue
Medium
CVE-2026-42998
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
Medium
CVE-2026-42999
OpenStack Keystone has an Authorization Bypass
High
CVE-2026-6075
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
Medium
CVE-2026-9243
The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
High
CVE-2026-44798
Nautobot: GitRepository.current_head field should not be writable through REST API
High
CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Medium
CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Medium
CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
High
CVE-2025-11262
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-3655
OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification
Low
CVE-2026-45756
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
Medium
CVE-2026-45755
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Medium
CVE-2025-14042
Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details
Medium
CVE-2026-45754
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.