Medium
CVE-2026-24955
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-69326
NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-32341
Benevolent <= 1.3.9 - Missing Authorization
High
CVE-2025-69383
shop <= 2.6.1 - Unauthenticated Local File Inclusion
High
CVE-2025-67991
User Extra Fields <= 16.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-69328
Booking and Rental Manager <= 2.5.9 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-67994
YayCurrency <= 3.3 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2026-32486
Travel Booking <= 1.3.9 - Missing Authorization
Medium
CVE-2026-0632
Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
Low
CVE-2026-2178
xcode-mcp-server vulnerable to Command Injection
Medium
CVE-2026-2130
mcp-maigret vulnerable to command injection
Medium
CVE-2026-25338
AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.4 - Missing Authorization
High
CVE-2026-39611
KuteShop <= 4.2.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-32329
Advanced Related Posts <= 1.9.1 - Missing Authorization
Medium
CVE-2026-32331
Textmetrics <= 3.6.4 - Missing Authorization
Medium
CVE-2026-25335
Secure Copy Content Protection and Content Locking <= 5.0.0 - Missing Authorization
Medium
CVE-2026-25337
Coachify <= 1.1.5 - Cross-Site Request Forgery
Medium
CVE-2026-32330
Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request Forgery
Medium
CVE-2026-25336
Coachify <= 1.1.5 - Missing Authorization
Medium
CVE-2026-32328
Lemmony < 1.7.1 - Cross-Site Request Forgery
High
CVE-2025-15100
JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
Critical
CVE-2025-15027
JAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user
Medium
CVE-2026-39610
WpXmas-Snow <= 1.1 - Missing Authorization
Medium
CVE-2026-39608
iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.