Critical
CVE-2026-5722
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-29199
phpBB has Password Reset Link Poisoning via Host Header injection
Low
CVE-2026-7738
@puchunjie/doc-tools-mcp has a Path Traversal Issue
Medium
CVE-2026-7733
Funadmin has an Improper Access Control Issue
Medium
CVE-2026-41471
Easy PayPal Events & Tickets <= 1.3 - Insecure Direct Object Reference to Unauthenticated Information Exposure
High
CVE-2026-40797
WebinarIgnition < 4.09.86 - Unauthenticated SQL Injection
Medium
CVE-2026-25863
Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service
Low
CVE-2026-7688
Dolibarr has an Injection issue
Low
CVE-2026-7689
Dolibarr has Insufficient Verification of Data Authenticity
High
CVE-2026-42663
Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-7645
sublinear-time-solver has a Path Traversal Issue
High
CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
Low
CVE-2026-7600
yii2-mcp-server has a Command Injection Issue
Medium
CVE-2026-42662
Event Tickets and Registration <= 5.27.5 - Missing Authorization
Medium
CVE-2026-39716
Flipmart <= 2.8 - Missing Authorization
Medium
CVE-2026-4790
Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
Medium
CVE-2026-6817
Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
High
CVE-2026-6320
Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
Medium
CVE-2026-5077
Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
High
CVE-2026-5324
Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
Medium
CVE-2026-4024
Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification
Medium
CVE-2026-4650
FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler
Medium
CVE-2026-6449
Booking for Appointments and Events Calendar – Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint
Medium
CVE-2026-6457
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.