Medium
CVE-2026-96342
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-75823
User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation
Medium
CVE-2026-86789
Connections Business Directory <= 10.4.67 - Unauthenticated Information Exposure
Medium
CVE-2026-97292
YITH WooCommerce Tab Manager <= 2.15.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-85576
All in One Files Upload for WooCommerce <= 2.0.16 - Missing Authorization
Medium
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Medium
CVE-2026-96817
MakeCommerce for WooCommerce <= 4.1.0 - Missing Authorization
High
CVE-2026-100143
FluentCart <= 1.6.4 - Unauthenticated Unauthorized Customer Account Access
Medium
CVE-2026-79618
User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation
Medium
CVE-2026-94274
YayReviews 1.0.4 - 1.4.0 - Unauthenticated Information Exposure
Medium
CVE-2026-97249
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation
High
CVE-2026-96343
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection
Medium
CVE-2026-88791
Safe Redirect Manager <= 2.2.0 - Unauthenticated Open Redirect
Medium
CVE-2026-97197
WebToffee WP Backup and Migration <= 1.6.0 - Missing Authorization
Medium
CVE-2026-91020
WebToffee Gift Cards for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary Gift Card Price Manipulation
Medium
CVE-2026-92424
Content Egg <= 11.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-100846
MONAI: Unsafe functions lead to pickle deserialization rce
High
CVE-2026-100845
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
High
CVE-2026-100842
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only
High
CVE-2026-100843
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
Unrated
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
High
CVE-2026-100844
MONAI vulnerable to OS command injection
Unrated
CVE-2026-100840
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $
Unrated
CVE-2026-100650
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB,
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.