Mittel
CVE-2026-15441
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.529
Hoch
CVE-2026-16099
Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter
Mittel
CVE-2025-10005
Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
Mittel
CVE-2026-18385
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
Mittel
CVE-2026-15602
NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
Mittel
CVE-2026-15066
Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
Mittel
CVE-2026-16779
Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action
Mittel
CVE-2026-12477
Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter
Mittel
CVE-2026-16079
Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content
Kritisch
CVE-2026-18432
Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter
Hoch
CVE-2026-15002
Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter
Mittel
CVE-2026-13358
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Mittel
CVE-2026-15009
Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
Mittel
CVE-2026-2487
Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting
Kritisch
CVE-2026-19598
Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
Mittel
CVE-2025-15657
School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference
Mittel
CVE-2026-15056
StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
Mittel
CVE-2026-13167
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
Mittel
CVE-2026-11780
Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter
Mittel
CVE-2026-2357
Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Kritisch
CVE-2026-18316
Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
Mittel
CVE-2026-12905
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Mittel
CVE-2026-55156
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
Hoch
CVE-2026-55157
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.