Critical
CVE-2026-4283
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-4662
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
Medium
CVE-2026-3138
Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE
Medium
CVE-2026-4587
HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client
Low
CVE-2026-4633
Keycloak's identity-first login flow exposes user information
Medium
CVE-2026-3079
LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
Medium
CVE-2026-4056
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
High
CVE-2026-4021
Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
Critical
CVE-2026-4001
Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
High
CVE-2026-3533
JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
High
CVE-2026-4306
WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter
Medium
CVE-2026-2412
Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
Medium
CVE-2026-3225
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
Medium
CVE-2026-4066
Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search
Medium
CVE-2026-4628
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
High
CVE-2026-4600
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
High
CVE-2026-4602
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
Critical
CVE-2026-4599
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
High
CVE-2026-4598
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
Low
CVE-2026-4603
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
High
CVE-2026-4601
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
Medium
CVE-2026-25007
ElementInvader Addons for Elementor <= 1.4.2 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-32573
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 - Authenticated (Editor+) Remote Code Execution
Medium
CVE-2026-25417
ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.