High
CVE-2026-1235
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-24564
Textmetrics <= 3.6.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Medium
CVE-2025-68039
BackItUp <= 2.1.0 - Missing Authorization
Medium
CVE-2025-67956
User Registration <= 4.4.6 - Missing Authorization
Medium
CVE-2026-24990
WP Docs <= 2.2.8 - Missing Authorization
High
CVE-2025-69318
JobWP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24565
B Accordion <= 2.0.2 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-68035
Tabby Checkout <= 5.8.4 - Unauthenticated Information Exposure
Medium
CVE-2026-24572
Nelio Content <= 4.2.0 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-67959
WorkScout <= 4.1.07 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-25310
Extend Link <= 2.0.0 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-24566
iNET Webkit <= 1.2.4 - Missing Authorization
High
CVE-2025-67955
MyHome Core <= 4.1.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-24568
Travel <= 11.1.0 - Missing Authorization
Medium
CVE-2026-24571
BOX NOW Delivery <= 3.0.2 - Missing Authorization
Medium
CVE-2026-1245
binary-parser library has a code injection vulnerability
Low
CVE-2025-66803
Turbo Frame responses can restore stale session cookies
Critical
CVE-2025-64087
XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability
Critical
CVE-2025-65482
XDocReport affected by an XML External Entity (XXE) vulnerability
Critical
CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
Medium
CVE-2026-22770
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
Low
CVE-2026-23522
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
Medium
CVE-2026-23626
Kimai has an Authenticated Server-Side Template Injection (SSTI)
High
CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.