High
CVE-2026-28463
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-26323
OpenClaw has a command injection in maintainer clawtributors updater
High
CVE-2026-26329
OpenClaw has a path traversal in browser upload allows local file read
Medium
CVE-2026-26328
OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities
High
CVE-2026-26327
OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
Medium
CVE-2026-2386
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
High
CVE-2026-2232
Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter
Medium
CVE-2026-39665
SEO Friendly Images <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39662
Product Price by Formula for WooCommerce <= 2.5.6 - Missing Authorization
Medium
CVE-2026-39666
Hello Bar Popup Builder <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-14445
Image Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta
Medium
CVE-2026-32374
The Minimal <= 1.2.9 - Missing Authorization
Medium
CVE-2026-1219
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
Medium
CVE-2025-14983
Advanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13048
Official StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname
Medium
CVE-2026-39663
TrueBooker <= 1.1.6 - Missing Authorization
Medium
CVE-2025-13113
Web Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-23545
Aruba HiSpeed Cache <= 3.0.4 - Missing Authorization
High
CVE-2025-12845
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
High
CVE-2026-23544
Valenti <= 5.6.3.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-32373
SMS Alert Order Notifications <= 3.9.0 - Missing Authorization
Medium
CVE-2026-32380
Numinous <= 1.3.0 - Missing Authorization
Medium
CVE-2025-14864
Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure
Medium
CVE-2026-32370
Influencer <= 1.1.7 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.