Medium
CVE-2026-97219
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-97287
Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection
Medium
3d2daf20-df96-4514-9ceb-93d86b690734
Virtue Premium <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-97261
Notivo Notification for WooCommerce <= 1.4.2 - Unauthenticated Information Exposure
Medium
CVE-2026-100513
CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-62079
Qi Addons For Elementor <= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-97288
WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-91022
Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting
Medium
CVE-2026-94298
BuildKit <= 1.0.28 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-97074
Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-102281
Nest: Remote process termination via a deeply nested microservice message pattern
Medium
CVE-2026-86472
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
Medium
CVE-2026-86818
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Critical
CVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
Medium
CVE-2026-101912
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Medium
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Medium
CVE-2026-17495
moment vulnerable to Path Traversal via crafted non-string locale name
Medium
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
High
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
High
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
High
CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Medium
CVE-2026-100699
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
High
CVE-2026-100700
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Medium
CVE-2026-114104
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.