Medium
CVE-2026-41322
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-41495
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
Critical
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Low
CVE-2026-6874
copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action
Medium
CVE-2025-69332
Bookify – Appointment Booking & Scheduling for WordPress <= 1.1.1 - Missing Authorization
High
CVE-2026-41557
Kapee < 1.7.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40785
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Missing Authorization
Medium
CVE-2026-40790
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-41556
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-40809
Metro Magazine <= 1.4.1 - Missing Authorization
Medium
CVE-2026-40788
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization
High
CVE-2026-40791
WP Time Slots Booking Form <= 1.2.46 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28040
E-cab Taxi Booking Manager for Woocommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62110
Rescue Shortcodes <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-40787
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-41554
Bricks <= 1.9.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-32489
bBlocks – Essential Gutenberg Blocks & Patterns Collection < 2.0.30 - Missing Authorization
Medium
CVE-2026-40792
KiviCare – Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-40789
Booking for Appointments and Events Calendar – Amelia <= 2.2 - Unauthenticated Information Exposure
Medium
CVE-2025-62104
ACF Galerie 4 <= 1.4.2 - Missing Authorization
High
CVE-2025-60085
Learnify - Online Courses Education WordPress Theme <= 1.15.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-64215
MasterStudy LMS Pro < 4.7.16 - Missing Authorization
Medium
CVE-2026-41511
OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle
High
CVE-2026-42075
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.