Medium
CVE-2026-40729
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-39704
Precious Metals Automated Product Pricing – Pro <= 4.1.2 - Missing Authorization
Medium
CVE-2026-39703
WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39702
Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32428
Popup Like box <= 3.7.7 - Missing Authorization
Medium
CVE-2026-39706
Make My Trivia <= 1.1.0 - Missing Authorization
Medium
CVE-2026-39701
ShopWP <= 5.2.4 - Missing Authorization
High
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
Medium
CVE-2026-28338
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
High
CVE-2026-2880
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
Low
CVE-2026-82259
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Medium
CVE-2026-18401
jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
Medium
CVE-2026-32425
Payment Gateway Pix For GiveWP <= 2.2.3 - Missing Authorization
High
CVE-2026-32426
Medilazar Core < 1.4.7 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Medium
CVE-2026-28415
Gradio has an Open Redirect in its OAuth Flow
High
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Medium
CVE-2026-28208
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
Medium
CVE-2026-32898
OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata
Medium
CVE-2026-4039
OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)
High
CVE-2026-27939
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Medium
CVE-2026-28352
Indico has a missing access check in the event series management API
High
CVE-2026-27836
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.