Medium
CVE-2026-28493
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Critical
CVE-2026-27591
Winter vulnerable to privilege escalation by authenticated backend users
Medium
CVE-2026-26284
ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.
Medium
CVE-2026-25986
ImageMagick has heap buffer overflow in YUV 4:2:2 decoder
Medium
CVE-2026-25982
ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)
Medium
CVE-2026-25971
ImageMagick: MSL - Stack overflow in ProcessMSLScript
Medium
CVE-2026-25970
ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption
High
CVE-2026-25968
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
Critical
CVE-2026-3059
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker
Critical
CVE-2026-3060
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module
Low
CVE-2026-2366
Keycloak vulnerable to authorization bypass via the Admin API
Medium
CVE-2026-31988
yauzl contains an off-by-one error
Low
CVE-2026-3965
@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure
Medium
CVE-2026-2987
Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'
High
CVE-2026-27067
Mobile App Editor – WordPress to Android App Builder <= 1.3.1 - Authenticated (Editor+) Arbitrary File Upload
Critical
CVE-2026-24373
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass
High
CVE-2026-27065
BuilderPress <= 2.0.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-39469
PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-1867
Guest posting / Frontend Posting / Front Editor – WP Front User Submit < 5.0.6 - Unauthenticated Information Exposure
Medium
CVE-2026-22209
Comments – wpDiscuz <= 7.6.46 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2026-24970
Energox <= 1.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-39536
RSVP and Event Management <= 2.7.16 - Unauthenticated Information Exposure
Medium
CVE-2025-15473
Timetics – Appointment Booking Calendar & Scheduling System < 1.0.52 - Missing Authorization
Medium
CVE-2026-32458
WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.7 - Authenticated (Editor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.