Medium
CVE-2026-27424
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-42756
QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly <= 3.2.7 - Authenticated (Contributor+) Arbitrary File Deletion
Critical
CVE-2026-5118
Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
Medium
CVE-2026-45443
PDF for Elementor Forms + Drag And Drop Template Builder <= 5.5.1 - Missing Authorization
Medium
CVE-2026-9059
Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-24573
Visualizer: Tables and Charts Manager for WordPress < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-45444
Gift Cards For WooCommerce Pro <= 4.2.6 - Unauthenticated Arbitrary File Upload
High
CVE-2026-42683
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24637
PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-42728
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48093
Code Embed <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-49466
Draft List < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_t
Medium
CVE-2026-6728
Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
High
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Critical
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
High
ghsa-7hgr-7h44-33w2
CamoFox MCP: Unauthenticated HTTP MCP browser-control surface
High
CVE-2026-46372
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Low
CVE-2026-46342
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
High
CVE-2026-45805
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Medium
CVE-2026-45802
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
High
CVE-2026-45799
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
Medium
CVE-2026-46357
HAX CMS: Denial of Service using Malicious Import Request
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.