Medium
CVE-2026-93341
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-92438
Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-89005
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-80338
CMB2 <= 2.12.0 - Missing Authorization
Medium
CVE-2026-88788
Text Styler <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-88846
MasterStudy LMS <= 3.7.49 - Missing Authorization to Account Registration
Medium
CVE-2026-88845
MasterStudy LMS <= 3.7.49 - Missing Authorization
Medium
CVE-2026-93662
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-89004
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-95600
TrustedLogin Connector <= 2.0.3 - Unauthenticated Information Exposure
Unrated
CVE-2026-94625
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can sen
Unrated
CVE-2026-94623
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion request
Unrated
CVE-2026-94626
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbit
Unrated
CVE-2026-94624
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can s
Unrated
CVE-2026-94622
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomple
Medium
CVE-2026-15095
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
High
CVE-2026-9231
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
Medium
CVE-2025-14486
PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
Medium
CVE-2025-14484
Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
High
CVE-2025-1281
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-14487
Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Medium
CVE-2025-1280
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-9004
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
Medium
CVE-2026-7622
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.