Medium
ghsa-8pcw-h6w9-h46g
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-3253
MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
Medium
CVE-2026-4806
Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset
Medium
CVE-2026-16302
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2026-18335
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
High
CVE-2026-77394
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
High
CVE-2026-76089
Formie: Missing authorization on sent notification resend modal exposes submission PII
High
CVE-2026-61814
Jawn: Quadratic parsing effort in AsyncParser
High
CVE-2026-59990
Jawn: Uncontrolled nesting depth in JSON parser
Medium
CVE-2026-15731
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Critical
CVE-2026-12227
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
High
CVE-2026-85682
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
High
CVE-2026-77193
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
Unrated
pysec-2026-3987
MemoryOS 2.0.34 was published with a credential-stealing binary
Medium
CVE-2026-96826
W4 Post List <= 3.0.6 - Authenticated (Editor+) SQL Injection
High
CVE-2026-76087
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
High
CVE-2026-76086
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Medium
CVE-2026-92692
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Medium
CVE-2026-77421
JLine: ReDoS in Nano Editor Regex Search Mode
High
CVE-2026-77422
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
High
CVE-2026-56679
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Medium
CVE-2026-56678
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
High
CVE-2026-56676
9router: Image prefetch DNS rebinding allows SSRF to internal services
High
CVE-2026-56675
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.