Medium
CVE-2026-4666
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-3488
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
High
CVE-2026-5231
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
Medium
CVE-2026-5162
Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
Medium
CVE-2026-4817
MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
Medium
CVE-2026-76226
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Critical
CVE-2026-32179
MsQuic has a Remote Elevation of Privilege Vulnerability
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Critical
CVE-2026-33807
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
Critical
CVE-2026-33805
Fastify's connection header abuse enables stripping of proxy-added headers
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Medium
CVE-2026-56761
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Critical
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution
Medium
CVE-2026-40500
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature
Medium
CVE-2026-4160
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
Critical
CVE-2026-41229
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
High
CVE-2026-41230
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
High
CVE-2026-41231
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
Medium
CVE-2026-41232
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
Medium
CVE-2026-41233
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
Medium
CVE-2026-65903
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Medium
CVE-2026-39540
Shipment Tracker for Woocommerce <= 1.5.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-40725
WooCommerce Product Filters 2.0.0 - 2.0.5 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.