Medium
CVE-2026-4341
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-4333
LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
Low
CVE-2026-4292
Django vulnerable to privilege abuse in ModelAdmin.list_editable
Low
CVE-2026-4277
Django vulnerable to privilege abuse in GenericInlineModelAdmin
High
CVE-2026-3902
Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
High
CVE-2026-35463
pyLoad: Improper Neutralization of Special Elements used in an OS Command
Medium
CVE-2026-4785
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2026-33034
Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
Medium
CVE-2026-33033
Django has potential DoS via MultiPartParser through crafted multipart uploads
Medium
CVE-2026-4379
LightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute
Medium
CVE-2026-2988
Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
Medium
CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Medium
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Medium
CVE-2025-14732
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
High
CVE-2026-3499
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
Critical
CVE-2026-3296
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
Medium
CVE-2026-4401
Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
Medium
CVE-2026-2263
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
Medium
CVE-2026-4394
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
Medium
CVE-2026-4406
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
High
Exploited in attacks
CVE-2026-34197
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Medium
CVE-2026-33227
Apache ActiveMQ: Improper validation and restriction of a classpath path name
Critical
CVE-2026-1114
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
Medium
CVE-2026-4065
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.