High
CVE-2026-7307
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-37981
Keycloak Account Resources user lookup contains broken access control
Medium
CVE-2026-37982
Keycloak: Unauthorized account takeover via WebAuthn token replay
Medium
CVE-2026-37979
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Medium
CVE-2026-37978
Keycloak: Information Disclosure via evaluate-scopes Admin API
High
CVE-2026-8727
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
High
CVE-2026-8726
georgringer/news has SQL Injection in extension "News system" (news)
Medium
CVE-2026-46722
TYPO3 ke_search XML External Entity Injection
Medium
CVE-2026-46724
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer
Medium
CVE-2026-46723
TYPO3 ke_search path traversal from arbitrary table configuration input
High
CVE-2026-8827
TYPO3 SQL Injection in extension "Address List" (tt_address)
Medium
CVE-2026-46721
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
Critical
CVE-2026-46725
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
High
CVE-2026-3985
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter
Medium
CVE-2026-8610
TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter
Medium
CVE-2026-7472
Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
High
CVE-2026-7467
Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
Medium
CVE-2026-6549
Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Medium
CVE-2026-8627
Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Medium
CVE-2026-8626
SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Medium
CVE-2026-8624
LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Medium
CVE-2026-8685
Infility Global <= 2.15.19 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-8424
Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2026-8423
JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.