High
CVE-2026-8679
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-7615
Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter
Medium
CVE-2026-8692
Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action
Medium
CVE-2026-7636
Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
Medium
CVE-2026-8684
MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
Medium
CVE-2026-7798
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
Medium
CVE-2026-15285
The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
High
CVE-2026-9011
Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
Medium
CVE-2026-82258
@sveltejs/kit: `query.batch` cross-talk
High
CVE-2026-46492
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
High
CVE-2026-46490
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
High
CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
Medium
CVE-2026-4070
Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter
Medium
CVE-2026-3481
WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter
High
CVE-2026-9018
Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter
Medium
CVE-2026-2518
FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
Medium
CVE-2026-9104
Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title
Medium
CVE-2026-6864
CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter
Medium
CVE-2026-7509
KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
Medium
CVE-2026-7249
Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging
High
CVE-2026-4834
WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter
Medium
CVE-2026-4843
GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
Medium
CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
Critical
CVE-2026-6960
BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.