Critical
CVE-2026-7304
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Medium
CVE-2026-8771
org.linlinjava:litemall-wx-api has an Injection issue
Low
CVE-2026-8769
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
Low
CVE-2026-8766
@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Medium
CVE-2026-42681
E2Pdf – Export Pdf Tool for WordPress <= 1.32.14 - Reflected Cross-Site Scripting
High
CVE-2026-8912
Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
Medium
CVE-2026-42682
wpForo Forum <= 3.0.6 - Missing Authorization
High
CVE-2026-39079
Sensitive data exposure via publicly accessible logs in upsshipping module from Agence Web 360 for PrestaShop
Medium
CVE-2026-8759
Beetl's SpELFunction extension function has an expression injection risk
Critical
CVE-2026-42680
Contest Gallery Pro <= 29.0.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-42679
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download
High
CVE-2018-25329
WP with Spritz <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2018-25324
Simple Fields <= 0.3.5 - Unauthenticated Local File Inclusion
High
CVE-2026-8719
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
High
CVE-2026-8657
jsondiffpatch patch APIs are vulnerable to prototype pollution
High
CVE-2020-37244
Membership by Supsystic <= 1.4.7 - Unauthenticated SQL Injection
Medium
CVE-2020-37235
Wibar <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2020-37227
Helios Solutions Brand Logo Slider <= 2.1 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2021-47979
Backup and Restore plugin – WordPress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-42678
GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2020-37246
Backup by Supsystic <= 2.3.9 - Unauthenticated Local File Inclusion
Medium
CVE-2026-45619
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
Medium
CVE-2026-45610
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.