Medium
CVE-2025-68026
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-68028
GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization
High
CVE-2025-69378
Product Filter for WooCommerce <= 9.1.2 - Authenticated (Shop Manager+) Privilege Escalation
High
CVE-2025-69374
Eleblog – Elementor Blog And Magazine Addons <= 2.0.3 - Unauthenticated Local File Inclusion
Low
CVE-2026-22254
Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager
Medium
CVE-2025-14079
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
High
CVE-2026-1294
All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
Medium
CVE-2026-1271
ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
Critical
CVE-2026-25632
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
Medium
CVE-2026-1654
Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2026-25631
n8n's domain allowlist bypass enables credential exfiltration
Medium
CVE-2025-13416
ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
Critical
CVE-2026-25630
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
High
CVE-2026-25593
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply
High
CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
High
CVE-2026-25546
godot-mcp has Command Injection via unsanitized projectPath
Critical
CVE-2026-25115
n8n has a Python sandbox escape
Critical
CVE-2026-25056
n8n Merge Node has Arbitrary File Write leading to RCE
High
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
High
CVE-2026-25054
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
Medium
CVE-2026-1319
Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field
Medium
CVE-2026-25475
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
Medium
CVE-2026-1268
Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field
Medium
CVE-2026-0867
Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.