Medium
CVE-2026-42475
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-42474
MixPHP Framework has an SQL injection vulnerability via crafted `data` array
High
CVE-2026-7649
ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter
High
CVE-2026-7647
Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection
High
CVE-2026-7049
PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
Medium
CVE-2026-6916
Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute
Medium
CVE-2026-6812
Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
High
CVE-2026-7641
Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
Medium
CVE-2026-4658
Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Medium
CVE-2025-14726
Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
Critical
CVE-2026-7458
User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
Critical
CVE-2026-4882
User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-7638
App Builder <= 5.6.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
Medium
CVE-2026-7209
Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-6378
Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API
High
CVE-2026-7579
AstrBot Makes Use of Hard-coded Password
Critical
CVE-2026-42778
Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)
Critical
CVE-2026-42779
Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)
Medium
CVE-2026-42404
Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API
High
CVE-2026-42402
Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization
High
CVE-2026-42403
Apache Neethi does not properly detect circular references in policy definitions.
Medium
CVE-2026-40201
@diplodoc/search-extension allows stored XSS via Markdown file title
High
CVE-2026-43001
OpenStack Keystone has an Incorrect Authorization Issue
High
CVE-2026-43003
OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.