Medium
CVE-2026-39513
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-39468
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-39463
ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39491
Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-39512
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection
High
CVE-2026-39474
Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-39511
WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection
Medium
CVE-2026-5335
Magic Export & Import <= 1.1.0 - Unauthenticated Information Exposure
High
CVE-2026-39494
Product Filter for WooCommerce by WBW <= 3.1.2 - Unauthenticated SQL Injection
Medium
CVE-2026-39525
Booking Activities <= 1.16.48.1 - Missing Authorization
High
CVE-2019-25710
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
Low
CVE-2026-6125
Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
Medium
CVE-2026-1116
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of
Critical
CVE-2026-5059
aws-mcp has a Command Injection Remote Code Execution Vulnerability
Medium
CVE-2026-5337
Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
High
CVE-2026-41139
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Medium
ghsa-55v6-g8pm-pw4c
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Medium
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
Medium
CVE-2026-40306
DNN: Same HostGUID for all new installs
Medium
CVE-2026-40305
DNN: Force Friend Request Acceptance
Medium
CVE-2026-40299
next-intl has an open redirect vulnerability
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.