Medium
CVE-2025-59060
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-1945
WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
Medium
CVE-2026-1980
WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
Medium
CVE-2026-1651
Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
High
CVE-2026-1273
PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
Low
CVE-2026-3449
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
Low
CVE-2026-3455
mailparser vulnerable to Cross-site Scripting
Medium
CVE-2026-32016
OpenClaw: macOS optional allowlist basename matching could bypass path-based policy
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
High
CVE-2026-32014
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy
Medium
CVE-2026-3691
OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state
Medium
ghsa-5847-rm3g-23mw
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
Medium
CVE-2026-32024
OpenClaw's avatar symlink traversal can expose out-of-workspace local files
High
CVE-2026-22454
Solaris <= 2.5 - Unauthenticated PHP Object Injection
High
CVE-2025-54001
Classter <= 2.5 - Unauthenticated PHP Object Injection
High
CVE-2025-68555
Nutrie < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-22446
Prowess - Fitness and Gym WordPress Theme <= 1.8.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27332
Agrofood < 1.4.0 - Reflected Cross-Site Scripting
High
CVE-2026-24960
Charety < 2.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-22451
Handyman <= 1.4 - Unauthenticated PHP Object Injection
High
CVE-2026-22457
Wanderland - Travel Blog <= 1.5 - Unauthenticated Local File Inclusion
High
CVE-2025-68886
Cookiteer <= 1.4.8 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2026-28039
wpDataTables (Premium) <= 6.5.0.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68553
Lendiz < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.