Medium
CVE-2026-40776
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-42640
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Missing Authorization
High
CVE-2026-42647
JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.7.7 - Unauthenticated SQL Injection
High
CVE-2026-42650
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42660
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-42656
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42629
PowerPack Pro for Elementor < v2.13.0 - Missing Authorization
Medium
CVE-2026-42657
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization
High
CVE-2026-42639
GD Rating System <= 3.6.2 - Unauthenticated SQL Injection
Medium
CVE-2026-42651
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.9 - Missing Authorization
Medium
CVE-2026-42654
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 - Missing Authorization
High
CVE-2026-2892
Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
High
CVE-2026-42649
Favicon Rotator <= 1.2.11 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42659
AFI – The Easiest Integration Plugin <= 1.126.12 - Missing Authorization
Medium
CVE-2026-41310
OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure
Medium
CVE-2026-40296
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
Medium
CVE-2026-35453
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
Medium
CVE-2026-32699
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
Critical
CVE-2026-24178
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A succe
Medium
CVE-2026-4019
Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint
Medium
CVE-2026-40968
Spring gRPC SecurityContext leaks across requests upon authorization failure
Low
CVE-2026-40969
Spring gRPC AuthenticationException messages are reflected to remote client
High
CVE-2026-41636
Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion
Medium
CVE-2026-40966
Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.