High
CVE-2026-2428
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-1565
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload
High
CVE-2026-27961
Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vul
Critical
CVE-2026-27941
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out a
Medium
CVE-2026-27948
Copyparty vulnerable to reflected XSS via setck parameter
Critical
CVE-2026-27952
Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sand
Medium
CVE-2026-27809
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
Medium
CVE-2026-28126
RH Frontend Publishing Pro < 4.3.4 - Reflected Cross-Site Scripting
Medium
e5b98a2c-faed-4e2b-8b94-31e2be95ad40
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Unauthenticated Reflected Cross-Site Scripting via 'title_tag' Parameter
High
CVE-2026-28123
Veil - Wedding & Photographer WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
Medium
CVE-2026-28113
Ultimate Learning Pro <= 3.9.1 - Reflected Cross-Site Scripting
High
CVE-2026-28121
Anderson <= 1.4.2 - Unauthenticated Local File Inclusion
Medium
CVE-2026-32418
Meow Gallery <= 5.4.4 - Authenticated (Author+) SQL Injection
Medium
CVE-2026-39694
Simply Schedule Appointments <= 1.6.11.0 - Missing Authorization
High
CVE-2026-28114
WooCommerce License Manager <= 7.0.6 - Authenticated (Shop Manager+) Arbitrary File Upload
Medium
CVE-2026-28135
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1052 - Missing Authorization
Medium
CVE-2026-28103
Responsive Zoom In/Out Slider WordPress Plugin <= 5.4.5 - Reflected Cross-Site Scripting
High
CVE-2026-28119
Nirvana <= 2.6 - Unauthenticated Local File Inclusion
High
CVE-2026-28120
Dr.Patterson <= 1.3.2 - Unauthenticated Local File Inclusion
High
CVE-2026-28124
Notarius - Legal Advisor WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
Medium
CVE-2026-28104
Site Suggest <= 1.3.9 - Missing Authorization
Medium
CVE-2026-28078
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download
High
CVE-2026-28125
Midi - Sound & Music WordPress Theme <= 1.14 - Unauthenticated Local File Inclusion
High
CVE-2026-28134
JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.