Medium
CVE-2026-25343
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,597
Medium
CVE-2026-39614
JW Player for WordPress <= 2.3.8 - Missing Authorization
Medium
CVE-2026-15286
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
Medium
CVE-2026-25423
Real 3D FlipBook <= 4.19.1 - Missing Authorization
Medium
CVE-2025-69390
Business Template Blocks for WPBakery (Visual Composer) Page Builder <= 1.3.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-39616
Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-0910
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-13391
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
High
CVE-2025-68552
WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-67998
Miraculous Elementor <= 2.0.7 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-32342
Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery
Medium
CVE-2026-39615
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-14778
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
High
CVE-2026-1486
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
High
CVE-2026-1529
Keycloak affected by improper invitation token validation
High
CVE-2026-1866
Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
High
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Medium
CVE-2026-1922
The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
High
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2026-25497
Craft CMS: GraphQL Asset Mutation Privilege Escalation
Medium
CVE-2026-25496
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
High
CVE-2026-25495
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Medium
CVE-2026-25494
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.