Medium
CVE-2026-31819
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-39504
InstaWP Connect <= 0.1.2.5 - Missing Authorization
Medium
CVE-2026-32457
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.18 - Missing Authorization
Medium
CVE-2026-32543
Responsive Blocks – Page Builder for Blocks & Patterns <= 2.2.0 - Missing Authorization
Medium
CVE-2026-39526
WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-31861
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
Medium
CVE-2026-31808
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header
High
CVE-2026-31802
node-tar Symlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-26801
pdfmake is vulnerable to server-side request forgery (SSRF)
High
CVE-2026-3231
Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field
Medium
CVE-2026-3492
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
Medium
CVE-2026-31853
ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder
Medium
CVE-2026-30883
ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder
High
CVE-2026-30837
Elysia has a string URL format ReDoS
Critical
CVE-2026-29793
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Critical
CVE-2026-29792
Feathers has an OAuth Callback Account Takeover issue
Medium
CVE-2026-28692
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
High
CVE-2026-1993
ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
Medium
CVE-2026-28689
ImageMagick has a Path Policy TOCTOU symlink race bypass
High
CVE-2026-1992
ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
High
CVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Medium
CVE-2026-2917
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
Medium
CVE-2026-2918
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.