Medium
CVE-2026-8703
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-8702
GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute
Medium
CVE-2026-8701
GNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-8698
Cryptocurrency Prijsvergelijking Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Medium
CVE-2026-8708
Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page
Medium
CVE-2026-7614
Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update
High
CVE-2026-8787
Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Critical
CVE-2026-8760
Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force
Medium
CVE-2026-8048
My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
Medium
CVE-2026-8040
faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
Critical
CVE-2026-23734
XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash
Medium
CVE-2026-6287
ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute
Medium
CVE-2026-9236
CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management
Medium
CVE-2025-14481
Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
Medium
CVE-2026-15299
Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
Medium
CVE-2026-9022
Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute
High
CVE-2026-9496
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Medium
CVE-2026-9495
@koa/router has an Access Control Bypass
Low
CVE-2026-9520
Blitz has a Cross-site Scripting issue
Low
CVE-2026-48589
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Low
CVE-2026-9497
TCC-TRANSACTION has an Improper Input Validation vulnerability
Medium
CVE-2026-44598
Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery
Medium
CVE-2026-43827
Apache Shiro has a session fixation vulnerability
Medium
CVE-2026-43828
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.