High
CVE-2026-42733
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-27398
RSVP and Event Management <= 2.7.16 - Missing Authorization
Medium
CVE-2025-62745
Team Showcase <= 1.22.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24582
FlexTable – Data Table Sync with Google Sheets <= 3.24.0 - Missing Authorization
Medium
CVE-2026-32389
NanoCare < 1.2.2 - Missing Authorization
High
CVE-2026-24937
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-8386
Go Maps <= 10.0.9 - Unauthenticated Information Exposure
Medium
CVE-2026-9278
Form Builder CP <= 1.2.46 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-24586
Newses <= 2.0.0.77 - Missing Authorization
Medium
CVE-2026-24527
Autoship Cloud for WooCommerce Subscription Products <= 2.14.3 - Missing Authorization
Medium
CVE-2026-27357
Search Analytics for WP < 1.5.0 - Missing Authorization
Medium
CVE-2026-24574
Export WordPress Pages to Static HTML & PDF — Static Site Export <= 6.0.0 - Cross-Site Request Forgery
Medium
CVE-2026-24554
Subscription & Recurring Payment for WooCommerce <= 1.9.1 - Cross-Site Request Forgery
High
CVE-2026-4372
HuggingFace transformers vulnerable to remote code execution
Medium
CVE-2026-42732
Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization
Critical
CVE-2026-42731
miniOrange OTP Login, Verification and SMS Notifications <= 5.4.9 - Unauthenticated Privilege Escalation
Medium
CVE-2026-42730
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-15546
Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite
Medium
CVE-2026-42686
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
ghsa-ggxf-37hm-9wqf
instagrapi: Unsafe signup challenge path handling in instagrapi
High
CVE-2026-47138
Parse Server: Pre-authentication denial of service via client version header regex backtracking
High
CVE-2026-42729
Property Hive <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-9061
Agile Store Locator <= 1.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2026-42684
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.