Hoch
CVE-2026-6939
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.422
Hoch
CVE-2025-6784
Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution
Mittel
CVE-2026-10041
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
Mittel
CVE-2026-12126
WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
Hoch
CVE-2026-13378
Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field
Hoch
CVE-2026-7655
SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook
Mittel
CVE-2026-49977
drupal/tacjs - SA-CONTRIB-2026-040
Hoch
CVE-2026-49866
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Mittel
CVE-2026-49865
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
Mittel
CVE-2026-1832
ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion
Mittel
CVE-2026-15096
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
Mittel
CVE-2026-15097
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
Mittel
CVE-2026-3552
SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action
Hoch
CVE-2026-2354
Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()
Mittel
CVE-2025-13968
Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Mittel
CVE-2026-6804
AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions
Mittel
CVE-2026-6803
AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'
Mittel
CVE-2026-7559
Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification
Mittel
CVE-2026-13250
Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action
Hoch
CVE-2026-14262
Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter
Mittel
CVE-2026-12141
Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
Mittel
CVE-2026-9738
Print, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' Parameter
Hoch
CVE-2026-3576
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
Mittel
CVE-2026-13116
PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.