Wysoka
CVE-2026-92438
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 8 950
Wyczyść filtry
Średnia
CVE-2026-15095
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
Wysoka
CVE-2026-9231
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
Średnia
CVE-2025-14486
PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
Średnia
CVE-2025-14487
Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Średnia
CVE-2025-1280
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
Średnia
CVE-2026-9004
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
Średnia
CVE-2026-7622
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Średnia
CVE-2026-16778
Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Średnia
CVE-2026-91092
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
Wysoka
CVE-2026-92969
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
Wysoka
CVE-2026-93836
WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
Średnia
CVE-2026-18439
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Średnia
CVE-2026-12995
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Wysoka
CVE-2026-94504
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Wysoka
CVE-2026-89412
TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
Wysoka
CVE-2026-12470
CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
Krytyczna
CVE-2026-13355
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Krytyczna
CVE-2026-19658
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Średnia
CVE-2026-94117
HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.3 - Authenticated (Administrator+) SQL Injection
Średnia
CVE-2026-90951
Paid Member Subscriptions <= 3.0.0 - Missing Authorization
Średnia
CVE-2026-83555
Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization
Średnia
CVE-2026-77766
Directorist 8.5 - 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Średnia
CVE-2026-84046
Directorist <= 8.9.4 - Authenticated (Subscriber+) Server-Side Request Forgery
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.