Medium
CVE-2026-1004
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-14375
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className
Medium
CVE-2025-14853
LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-0916
Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
Medium
CVE-2021-47776
Umbraco CMS contains a server-side request forgery vulnerability
Medium
CVE-2025-14793
DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery
High
CVE-2021-47763
Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter
Medium
CVE-2026-0942
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion
Medium
CVE-2026-0939
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
Medium
CVE-2026-23496
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
Medium
CVE-2026-23495
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
Medium
CVE-2026-23494
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
High
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
High
CVE-2026-22803
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
High
CVE-2026-22774
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse
High
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
High
CVE-2025-12957
All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
Medium
CVE-2025-14384
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
Medium
CVE-2025-14982
Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-15370
Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
Medium
CVE-2025-12641
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion
Low
CVE-2026-0976
Keycloak has an improper input validation vulnerability
High
CVE-2025-13062
Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass
Medium
CVE-2025-12895
Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.