Średnia
CVE-2026-4792
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 8 950
Wyczyść filtry
Krytyczna
CVE-2026-89274
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
Średnia
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Średnia
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Średnia
CVE-2026-15660
SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
Wysoka
CVE-2026-92807
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
Krytyczna
CVE-2026-84434
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Średnia
CVE-2026-15760
Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
Średnia
CVE-2026-89093
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Średnia
CVE-2026-89334
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Średnia
CVE-2026-87067
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
Wysoka
CVE-2026-87909
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
Wysoka
CVE-2026-85017
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
Średnia
CVE-2026-85113
GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution
Średnia
CVE-2026-13471
LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Średnia
CVE-2026-14472
Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
Średnia
CVE-2026-75961
NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
Średnia
CVE-2026-16777
Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
Średnia
CVE-2026-92622
Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Średnia
CVE-2026-92249
Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Wysoka
CVE-2026-14323
Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
Średnia
CVE-2026-90981
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
Średnia
CVE-2026-17576
InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
Wysoka
CVE-2026-89413
Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.