Wysoka
CVE-2026-19991
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 8 950
Wyczyść filtry
Średnia
CVE-2026-12215
OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
Średnia
CVE-2026-11496
Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
Średnia
CVE-2026-15439
GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
Wysoka
CVE-2026-77807
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
Wysoka
CVE-2026-82845
Masteriyo LMS <= 3.4.0 - Authenticated (Subscriber+) PHP Object Injection
Średnia
CVE-2026-87916
WPBot <= 8.5.9 - Unauthenticated Information Exposure
Średnia
CVE-2026-62134
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Średnia
CVE-2026-18386
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
Wysoka
CVE-2026-14873
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
Wysoka
CVE-2026-15019
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Wysoka
CVE-2026-81803
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1224 - Authenticated (Subscriber+) Remote Code Execution
Średnia
CVE-2026-81022
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure
Średnia
CVE-2026-86809
المنتور فارسی 2.7.10 - 2.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion
Wysoka
CVE-2026-81805
SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps <= 2.1.5 - Unauthenticated Privilege Escalation
Średnia
CVE-2026-86813
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection
Wysoka
CVE-2026-86779
Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.6 - Authenticated (Contributor+) Arbitrary File Deletion
Wysoka
CVE-2026-80099
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
Wysoka
CVE-2026-14359
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
Średnia
CVE-2026-15398
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Wysoka
CVE-2026-75927
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
Średnia
42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
Wysoka
CVE-2026-76009
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
Średnia
CVE-2026-19946
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.