Medium
CVE-2025-13431
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Low
CVE-2026-23901
Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability
Medium
CVE-2025-11537
Keycloak logs sensitive headers
Critical
CVE-2026-23906
Apache Druid Vulnerable to Authentication Bypass
Medium
CVE-2025-15524
Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
High
CVE-2025-14541
Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
Medium
CVE-2026-25957
Cube Core is vulnerable to Denial of Service (DoS) via crafted request
High
CVE-2026-25958
Cube Core is vulnerable to privilege escalation via a specially crafted request
High
CVE-2026-25951
FUXA Affected by a Path Traversal Sanitization Bypass
Critical
CVE-2026-25939
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Critical
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Medium
ghsa-8grv-jq2g-cfhw
amphp/http-server affected by HTTP/2 DDoS vulnerability
Medium
CVE-2026-25918
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
High
CVE-2026-25892
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Medium
CVE-2026-25878
FroshAdminer Adminer UI is accessible without admin session
Medium
CVE-2025-69389
Visitor Maps Extended Referer Field <= 1.2.6 - Reflected Cross-Site Scripting
Medium
b27c7002-985c-4de9-b46a-440adf2a1662
Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-1560
Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-39613
Boutique <= 2.3.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25343
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-39614
JW Player for WordPress <= 2.3.8 - Missing Authorization
Medium
CVE-2026-15286
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
Medium
CVE-2026-25423
Real 3D FlipBook <= 4.19.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.