Critical
CVE-2026-89274
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-89081
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Medium
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Medium
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Medium
CVE-2026-15660
SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
High
CVE-2026-92807
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
Medium
CVE-2026-92967
Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
Critical
CVE-2026-84434
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Critical
CVE-2026-92229
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Medium
CVE-2026-15760
Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
Medium
CVE-2026-89093
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Medium
CVE-2026-89334
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
Medium
CVE-2026-77820
WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
High
CVE-2026-81650
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-92422
Meow Gallery <= 5.5.4 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-14844
Master Slider <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-81652
NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-87840
Tripzzy <= 1.5.0 - Missing Authorization
Medium
CVE-2026-84223
Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-16542
Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2026-87839
Tripzzy <= 1.5.0 - Missing Authorization
Low
CVE-2026-81653
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
Medium
CVE-2026-87067
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.