Low
CVE-2026-6216
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-33899
ImageMagick has a heap-Buffer-Overflow write of a single zero byte when parsing xml.
Medium
CVE-2026-34238
ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds
Medium
CVE-2026-33900
ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds
Medium
CVE-2026-4109
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Medium
CVE-2026-2582
Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-35582
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
High
CVE-2026-28291
simple-git Affected by Command Execution via Option-Parsing Bypass
High
CVE-2026-3017
Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2026-33858
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru
Medium
CVE-2025-66236
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Medium
CVE-2026-4479
WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-4059
ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
Medium
CVE-2026-1607
Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2026-6227
BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter
High
CVE-2026-4388
Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box
Critical
CVE-2026-4365
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
High
CVE-2026-4352
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
Medium
CVE-2026-35565
Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata
High
CVE-2026-35337
Apache Storm: Deserialization of Untrusted Data vulnerability
Medium
CVE-2026-6203
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
Critical
CVE-2026-4810
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability
High
CVE-2026-39531
WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection
High
CVE-2026-39530
SpeakOut! Email Petitions <= 4.6.5 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.