Medium
CVE-2026-27621
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Critical
CVE-2026-27614
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Medium
CVE-2026-27612
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard
High
CVE-2026-1311
Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload
Medium
ghsa-mhc9-48gj-9gp3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
Low
CVE-2026-25984
ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
Medium
CVE-2026-2356
User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
High
CVE-2026-1779
User Registration & Membership <= 5.1.2 - Authentication Bypass
Medium
CVE-2026-2489
TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea
Medium
CVE-2026-2029
Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes
High
CVE-2026-1557
WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
Medium
CVE-2026-2498
WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Medium
CVE-2026-2499
Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting
Medium
CVE-2026-2506
EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'
Medium
CVE-2026-2694
The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
Medium
CVE-2026-27645
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
High
CVE-2026-27696
changedetection.io is Vulnerable to SSRF via Watch URLs
High
CVE-2026-22442
Tribe <= 1.7.3 - Unauthenticated Local File Inclusion
Medium
CVE-2026-39520
weDocs <= 2.1.18 - Missing Authorization
High
CVE-2026-22436
Helvig <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2026-22416
FixTeam | Electronics & Mobile Devices Repair WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
High
CVE-2026-22389
Cocco - Kids Store and Baby Shop WordPress Theme <= 2.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-39693
FSM Custom Featured Image Caption <= 1.25.1 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-22387
Aviana <= 2.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.