Medium
CVE-2026-1839
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-39434
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.26 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-3396
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
Medium
CVE-2026-34899
LTL Freight Quotes – Worldwide Express Edition <= 5.2.1 - Missing Authorization
High
CVE-2026-34894
Integrio Core < 1.2.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-1672
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
Medium
CVE-2026-4654
Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
High
CVE-2026-34893
Thegov Core < 2.0.23 - Unauthenticated Local File Inclusion
Medium
CVE-2026-2509
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
Medium
CVE-2026-39433
WPAMS - Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Medium
CVE-2026-34898
Event Tickets Manager for WooCommerce <= 1.5.3 - Missing Authorization
Medium
CVE-2026-34896
Under Construction, Coming Soon & Maintenance Mode <= 2.1.1 - Cross-Site Request Forgery
Medium
CVE-2026-34904
Simple Social Media Share Buttons – Social Sharing for Everyone <= 6.2.0 - Cross-Site Request Forgery
High
CVE-2026-34902
Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-34895
Softlab Core < 1.2.11 - Unauthenticated Local File Inclusion
Critical
CVE-2026-34901
iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-1900
Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change
Medium
CVE-2026-34903
Ocean Extra <= 2.5.3 - Missing Authorization
High
CVE-2026-3243
Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal
Medium
CVE-2026-1673
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
Medium
CVE-2026-39432
Timetics – Appointment Booking & Scheduling <= 1.0.53 - Missing Authorization
Critical
CVE-2026-35615
PraisonAI Has Path Traversal in FileTools
Critical
CVE-2026-39305
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
Low
CVE-2026-86203
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.