Medium
CVE-2026-27367
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-27385
DesignThemes Portfolio <= 1.3 - Reflected Cross-Site Scripting
Medium
CVE-2026-27375
Gecko 6.0 - Responsive Shopify Theme - RTL support <= 1.9.8 - Reflected Cross-Site Scripting
High
CVE-2026-27379
NextScripts: Social Networks Auto-Poster <= 4.4.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-27383
Metro <= 2.13 - Unauthenticated Local File Inclusion
Medium
CVE-2026-23693
ElementsKit Elementor addons Lite < 3.7.9 - Missing Authorization
Medium
CVE-2026-27373
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.3 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-27381
Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.15 - Unauthenticated Local File Inclusion
High
CVE-2026-27369
Celeste <= 1.3.6 - Unauthenticated PHP Object Injection
Medium
CVE-2026-32411
Embed Calendly <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-40723
Bricks Builder <= 2.1.4 - Missing Authorization
Medium
CVE-2026-39692
tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-27374
WooCommerce Order Details <= 3.1 - Missing Authorization
Medium
CVE-2026-27376
Claue - Clean, Minimal Elementor WooCommerce <= 2.2.7 - Reflected Cross-Site Scripting
Unrated
840
Novarain/Tassos Framework - SQL Injection
Unrated
841
EasyDiscuss by Stackideas - SQL Injection
Medium
CVE-2026-27128
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Medium
CVE-2026-27126
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Medium
CVE-2026-25545
Astro has Full-Read SSRF in error rendering via Host: header injection
High
CVE-2025-70058
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent
Critical
CVE-2026-23552
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
High
CVE-2026-25747
Apache Camel Deserializes Untrusted Data in its LevelDB Component
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.