Mittel
CVE-2026-13191
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 71.528
Mittel
CVE-2026-75959
GoPay for WooCommerce <= 1.0.34 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
Mittel
CVE-2026-1242
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Mittel
CVE-2026-1984
Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
Mittel
CVE-2026-5400
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
Mittel
CVE-2026-7527
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Hoch
CVE-2026-85658
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
Mittel
CVE-2026-9615
Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
Mittel
CVE-2026-87917
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Mittel
CVE-2026-9232
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Mittel
CVE-2026-9855
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Mittel
CVE-2026-13770
AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
Mittel
CVE-2026-4792
Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure
Hoch
CVE-2026-93749
source-map-js allows event-loop denial of service through indexed source-map section offsets
Hoch
CVE-2026-93748
http-cache-semantics max-stale handling can disclose cross-user cached responses
Hoch
CVE-2026-93687
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
Mittel
CVE-2026-71537
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Hoch
CVE-2026-85058
io.moquette:moquette-broker has a Missing Authorization issue
Hoch
CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
Hoch
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Mittel
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass
Hoch
ghsa-39wr-7q6h-cf68
LMDeploy has an SSRF bypass
Hoch
ghsa-jr78-w6w5-m8f8
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
Mittel
ghsa-9rcc-pmj8-ffhr
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.