Medium
CVE-2026-1293
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2026-25641
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses
Critical
CVE-2026-25587
@nyariv/sandboxjs has a Sandbox Escape vulnerability
Critical
CVE-2026-25586
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
Medium
CVE-2026-25574
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
Critical
CVE-2026-25544
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
Critical
CVE-2026-25520
@nyariv/sandboxjs has a Sandbox Escape issue
High
CVE-2026-1499
WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action
Medium
CVE-2026-1252
Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field
Medium
CVE-2026-1785
Code Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actions
Medium
CVE-2026-1279
Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute
Low
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Medium
CVE-2026-1888
Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Low
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Medium
CVE-2026-1909
WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
Medium
CVE-2026-1808
Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Low
CVE-2025-70792
Microweber Cross-site Scripting vulnerability
Low
CVE-2025-70791
Microweber has a Cross-site Scripting vulnerability
Medium
CVE-2025-10753
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization
Medium
CVE-2026-25533
Sandbox escape via infinite recursion and error objects
Medium
CVE-2026-1228
Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute
Medium
CVE-2026-1927
GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css
Critical
CVE-2026-25752
FUXA Unauthenticated Remote Arbitrary Device Tag Write
Critical
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.