High
CVE-2026-34359
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Critical
CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
High
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Medium
CVE-2026-1877
Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
Medium
CVE-2026-1834
Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Medium
CVE-2026-1797
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
Medium
CVE-2026-1710
WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
Medium
CVE-2026-4146
Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter
Medium
CVE-2026-4020
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Critical
CVE-2026-3300
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
High
CVE-2026-5130
Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
Critical
CVE-2026-4257
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
Medium
CVE-2026-45214
Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-15433
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Critical
CVE-2025-15488
Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
Critical
CVE-2026-1969
ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-1430
WP Lightbox 2 < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-1890
LeadConnector < 3.0.22 - Missing Authorization
High
CVE-2026-0560
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function
High
CVE-2026-0562
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function i
Critical
CVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not e
Medium
CVE-2026-35651
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.