Medium
CVE-2026-0636
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-5598
Bouncy Castle Has Covert Timing Channel Vulnerability
High
CVE-2026-3505
Bouncy Castle Uncontrolled Resource Consumption vulnerability
High
CVE-2026-40458
PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
Medium
CVE-2026-31317
Craftql vulnerable to Server-Side Request Forgery
High
CVE-2026-6518
CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution
Medium
CVE-2026-4801
Page Builder Gutenberg Blocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data
Medium
CVE-2026-6048
Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes
Medium
CVE-2026-1838
Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter
Medium
CVE-2026-1559
Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
High
CVE-2026-2262
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
Medium
CVE-2026-2434
Pz-LinkCard <= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-5718
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
High
CVE-2026-5710
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field
High
CVE-2026-3464
WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
High
CVE-2026-39527
WpStream – Live Streaming, Video on Demand, Pay Per View < 4.11.2 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
a882c3d9-b4c1-4743-b930-382ca1081bab
WowShipping Pro 1.0.6 - Injected Backdoor
Medium
CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Critical
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
High
ghsa-f5v8-v6q3-q4h6
Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)
Critical
ghsa-3xx2-mqjm-hg9x
Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise
Medium
ghsa-fpw4-p57j-hqmq
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
Medium
ghsa-p7mm-r948-4q3q
Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server
Critical
ghsa-47wq-cj9q-wpmp
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.