Medium
CVE-2026-86604
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-82843
OAuth Server <= 6.3.0 - Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
Medium
CVE-2026-86842
Real3D Flipbook Lite <= 5.3 - Missing Authorization
Medium
CVE-2026-86608
Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated Arbitrary User Meta Corruption
Medium
CVE-2026-87070
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass
Medium
CVE-2026-84150
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-86785
Social Commerce for WooCommerce <= 2.5.4 - Missing Authorization
Medium
CVE-2026-93989
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token i
Medium
CVE-2026-93928
E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization
Medium
CVE-2026-87848
MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Information Exposure
Critical
CVE-2026-82187
WooCommerce Online Product Designer <= 2.14.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-93840
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the o
Medium
CVE-2026-93841
vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary
Medium
CVE-2026-9858
Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Medium
CVE-2026-8354
Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
Medium
CVE-2026-9766
Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
Medium
CVE-2026-9289
WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
Medium
CVE-2026-5410
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Medium
CVE-2026-9613
Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Medium
CVE-2026-18346
TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
Medium
CVE-2026-1256
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
Medium
CVE-2026-76579
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter
High
CVE-2026-1255
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
Medium
CVE-2026-6295
WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.