High
CVE-2026-22031
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-69198
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
Medium
CVE-2026-1180
Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)
Critical
CVE-2025-15521
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
Low
CVE-2026-1195
MineAdmin improperly refreshes tokens
Low
CVE-2026-1196
MineAdmin May Expose Sensitive Information to an Unauthorized Actor
Medium
CVE-2026-0690
FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta
Medium
CVE-2026-0608
Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
High
CVE-2026-0726
Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'
Medium
CVE-2026-0554
NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset
High
CVE-2025-15380
NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'
High
CVE-2025-15347
Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Medium
CVE-2026-0548
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
Medium
CVE-2025-15043
The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
Medium
CVE-2026-1194
MineAdmin May Expose Sensitive Information to an Unauthorized Actor
Low
CVE-2026-1193
MineAdmin has Incorrect Privilege Assignment
Medium
CVE-2026-22218
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value,
Medium
CVE-2025-68838
MemberPress Discord Addon <= 1.1.4 - Reflected Cross-Site Scripting
High
CVE-2025-67952
Grand Tour < 5.6.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-22337
Directorist Social Login <= 2.1.1 - Unauthenticated Privilege Escalation
High
CVE-2025-24648
Admin and Site Enhancements (ASE) <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-68882
Scalenut <= 1.1.3 - Missing Authorization
High
CVE-2025-67944
Nelio AB Testing <= 8.1.8 - Authenticated (Editor+) Remote Code Execution
Medium
CVE-2025-68835
Ravpage <= 2.40 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.