Critical
CVE-2026-25053
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-1246
ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
Critical
CVE-2026-25052
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
High
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
Critical
CVE-2026-25049
n8n Has Expression Escape Vulnerability Leading to RCE
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
Critical
CVE-2026-21893
n8n Vulnerable to Command Injection in Community Package Installation
High
CVE-2025-61917
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
Unrated
CVE-2026-1917
drupal/login_disable - SA-CONTRIB-2026-008
Medium
CVE-2026-1622
Neo4j Enterprise and Community vulnerable to a potential information disclosure
High
CVE-2025-13192
Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
Medium
CVE-2025-68834
Sync Master Sheet – Product Sync with Google Sheet for WooCommerce <= 1.1.3 - Missing Authorization
Medium
CVE-2025-68024
Addonify – WooCommerce Wishlist <= 2.0.15 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2025-67982
Urna <= 2.5.12 - Unauthenticated Local File Inclusion
High
CVE-2025-68841
TopperPack – Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68022
Plugin BlueX for WooCommerce <= 3.1.4 - Missing Authorization
Medium
CVE-2025-68023
Addonify – Compare Products For WooCommerce <= 1.1.17 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2025-69373
VidoRev <= 2.9.9.9.9.9.7 - Unauthenticated Local File Inclusion
Medium
CVE-2026-24988
The Events Calendar Shortcode & Block <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-68853
Contact Manager <= 9.1 - Unauthenticated PHP Object Injection
High
CVE-2025-67981
Besa <= 2.3.15 - Unauthenticated Local File Inclusion
High
CVE-2026-25027
Unicamp <= 2.7.1 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-69324
NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-67980
Hara <= 1.2.17 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.