Medium
CVE-2026-41148
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,563
High
CVE-2026-40607
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
Medium
CVE-2026-40598
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
High
CVE-2026-40597
MantisBT has a Content Security Policy bypass via attachments
High
CVE-2026-40596
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
Medium
CVE-2026-39960
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
High
CVE-2026-39850
Yii 2: Local file inclusion via view parameter name collision
Medium
CVE-2026-34970
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
Medium
CVE-2026-34754
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
Medium
CVE-2026-34744
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
Medium
CVE-2026-34579
MantisBT has an authorization bypass in private issue monitoring
High
CVE-2026-34463
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
Medium
CVE-2026-34390
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator
Medium
CVE-2026-3604
WP SEO Structured Data Schema <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameter
Medium
CVE-2026-2300
BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block
Medium
CVE-2026-4301
Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter
High
CVE-2026-2993
AI Chatbot & Workflow Automation by AIWU <= 1.5.6 - Unauthenticated SQL Injection in getListForTbl()
Medium
CVE-2026-4920
Next Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
Medium
CVE-2026-4859
SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute
Medium
CVE-2026-6932
Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form
Medium
CVE-2026-6663
GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent
Medium
CVE-2026-7464
WP Google Maps Integration <= 1.2 - Reflected Cross-Site Scripting via 'page' Parameter
Medium
CVE-2026-7437
AzonPost <= 1.3 - Reflected Cross-Site Scripting
Medium
CVE-2026-7626
Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.