High
CVE-2026-2413
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2025-13067
Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
High
CVE-2026-3453
ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
Medium
CVE-2026-1781
MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
Medium
CVE-2025-12473
RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
Medium
CVE-2026-2324
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Medium
CVE-2026-2569
Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels
Medium
CVE-2026-30964
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
Medium
CVE-2026-30959
OneUptime has WhatsApp Resend Verification Authorization Bypass
Critical
CVE-2026-30957
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
Critical
CVE-2026-30956
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
High
CVE-2026-30952
liquidjs has a path traversal fallback vulnerability
Medium
CVE-2026-3089
Actual Sync Server has an Authenticated Path Traversal
High
CVE-2026-30939
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
Medium
CVE-2026-30938
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
High
CVE-2026-30925
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Medium
CVE-2026-30913
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
Medium
CVE-2026-24382
News Magazine X <= 1.2.50 - Missing Authorization
High
CVE-2026-1454
Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-27076
LuxeDrive <= 1.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-3589
WooCommerce < 10.5.3 - Cross-Site Request Forgery
High
CVE-2026-27080
Deston <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2026-27077
MultiOffice <= 1.2 - Unauthenticated Local File Inclusion
Medium
aa7b7474-c170-42a2-be88-0fe410a2e71b
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.