Medium
CVE-2026-42671
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,540
Medium
CVE-2026-45436
WPBakery Page Builder <= 8.7.2 - Missing Authorization
High
CVE-2026-23970
Redirection for Contact Form 7 <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-7525
My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
High
CVE-2026-4030
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
High
CVE-2026-4031
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception
Medium
CVE-2026-5243
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
High
CVE-2026-42668
Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token
Medium
CVE-2026-44652
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
Medium
CVE-2026-44651
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
Critical
CVE-2026-44650
SillyTavern has a Path Traversal issue
Critical
CVE-2026-44649
SillyTavern has Authentication Bypass via SSO Header Injection
High
CVE-2026-44648
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
High
CVE-2026-4798
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Medium
CVE-2026-4782
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Critical
CVE-2026-33117
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
Critical
CVE-2026-31236
llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
Critical
CVE-2026-31235
imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
Critical
CVE-2026-31237
Ludwig framework is vulnerable to insecure deserialization through its predict() method.
Critical
CVE-2026-31239
mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
Critical
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Critical
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
High
CVE-2026-31221
PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.