High
CVE-2026-87909
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-92541
Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation
Low
CVE-2026-81651
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
Medium
CVE-2026-92423
Meow Gallery <= 5.5.4 - Authenticated (Author+) Information Exposure
Medium
CVE-2026-92965
TikTok 1.2.0 - 1.4.1 - Missing Authorization
Medium
CVE-2026-92410
Sign-up Sheets <= 2.3.0 - Cross-Site Request Forgery
High
CVE-2026-87068
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation
High
CVE-2026-82842
SAML Single Sign On <= 5.0.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-86802
To Do List Member <= 1.6 - Unauthenticated Content Injection
High
CVE-2026-85017
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-2278
VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
Medium
CVE-2026-85113
GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-81654
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
High
CVE-2026-92540
Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation
Unrated
CVE-2026-93436
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0
High
CVE-2026-87915
Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
High
CVE-2026-18405
Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-90884
WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
Medium
CVE-2026-15797
Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
High
CVE-2026-72819
Grav CMS vulnerable to remote code execution via .zip file upload
High
CVE-2026-75837
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Medium
CVE-2026-75834
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Critical
CVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Critical
CVE-2026-75828
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.