High
CVE-2026-103262
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,406
High
CVE-2026-103263
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Medium
CVE-2026-100689
GitPython submodule update path traversal can write outside the repository
Medium
CVE-2026-93981
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
Medium
CVE-2026-102983
Astro: Netlify Image CDN allowlist bypass enables SSRF
High
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
High
CVE-2026-92144
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Medium
CVE-2026-96256
Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
Medium
CVE-2026-89427
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
High
CVE-2026-85235
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
High
CVE-2026-92244
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
High
CVE-2026-97661
Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
High
CVE-2026-15983
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Medium
CVE-2026-100184
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Medium
CVE-2026-100179
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Medium
CVE-2026-101925
bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
Medium
CVE-2026-96268
Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
High
CVE-2026-14995
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
High
CVE-2026-96573
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
Medium
CVE-2026-90992
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.