Medium
CVE-2026-5070
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-3878
WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'
Medium
CVE-2026-3885
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
Medium
CVE-2026-3299
WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode
Critical
CVE-2026-4880
Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication
Medium
CVE-2026-4949
ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
Medium
CVE-2025-15636
Video Gallery – YouTube Gallery & Responsive Video Playlist <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-6372
Accept Cryptocurrencies with Plisio <= 2.0.6 - Missing Authorization
Medium
CVE-2026-6370
Mini Ajax Cart for WooCommerce <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-15635
Smart Online Order for Clover <= 1.6.4 - Cross-Site Request Forgery
Medium
CVE-2025-63029
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection
Medium
CVE-2025-53444
UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery
Medium
CVE-2026-40784
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 1.91.2 - Authenticated (Board Member+) Insecure Direct Object Reference
Low
ghsa-g4vj-cjjj-v7hg
Defense in Depth update for NuGet Client
High
CVE-2026-2332
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
High
CVE-2026-41134
Kiota: Code Generation Literal Injection
Low
ghsa-fj52-5g4h-gmq8
pyLoad's Session Not Invalidated After Permission Changes
Medium
CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Medium
CVE-2026-41129
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
Medium
CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Low
ghsa-fcpv-w245-r2q7
DotNetNuke.Core security code analysis rules triggered
Low
CVE-2026-56365
ImageMagick has a memory leak in PNG encoder when writing a MNG image
Low
CVE-2026-56370
ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts
Low
CVE-2026-56372
ImageMagick has a heap buffer overflow read in magnify operation via unrecognized magnify:method value
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.