High
CVE-2026-27095
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-2830
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
High
CVE-2026-22496
Hypnotherapy - Psychologist Theme <= 1.2.10 - Unauthenticated Local File Inclusion
High
CVE-2026-22508
Dentalux | Dentist & Healthcare Site Template <= 3.3 - Unauthenticated Local File Inclusion
High
CVE-2026-22504
ProLingua <= 1.1.12 - Unauthenticated Local File Inclusion
High
CVE-2026-22495
Greenville | Private School & University Education WordPress Theme <= 1.3.2 - Unauthenticated Local File Inclusion
Medium
CVE-2025-69347
Subscription for WooCommerce – WordPress Recurring Payments Plugin <= 1.8.10 - Authenticated (Customer+) Insecure Direct Object Reference
Medium
CVE-2026-2025
Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more < 1.19.5 - Unauthenticated Information Disclosure
Medium
CVE-2026-22491
My auctions allegro <= 3.6.34 - Reflected Cross-Site Scripting
High
CVE-2026-22494
Good Homes <= 1.3.13 - Unauthenticated Local File Inclusion
High
CVE-2026-22485
My Album Gallery <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-22493
Gaspard <= 1.3 - Unauthenticated Local File Inclusion
High
CVE-2026-22500
m2 | Construction and Tools Store <= 1.1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-27093
Tripgo < 1.5.6 - Unauthenticated Local File Inclusion
High
CVE-2026-22513
Triompher | Golf Course & Sports Club WordPress Theme <= 1.1.0 - Unauthenticated Local File Inclusion
High
CVE-2026-22502
Mr. Cobbler | Custom Shoemaking & Footwear Repairs WordPress Theme <= 1.1.9 - Unauthenticated Local File Inclusion
High
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
High
CVE-2026-0847
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and Brack
High
ghsa-5hwf-rc88-82xm
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
High
CVE-2026-29062
jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
High
CVE-2026-29069
Craft CMS has unauthenticated activation email trigger with potential user enumeration
Medium
CVE-2026-28685
Kimai's API invoice endpoint missing customer-level access control (IDOR)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.