Średnia
CVE-2026-74008
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 71 528
Średnia
CVE-2026-74009
Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
Krytyczna
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Wysoka
CVE-2026-19693
extract-zip allows arbitrary file writes through symlink archive entries
Wysoka
CVE-2026-53728
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
Wysoka
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
Wysoka
CVE-2026-11801
WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
Wysoka
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
Wysoka
CVE-2026-73393
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting
Średnia
CVE-2026-32549
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
Wysoka
CVE-2026-73339
Modern Events Calendar < 7.35.0 - Unauthenticated SQL Injection
Średnia
CVE-2026-32466
Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection
Wysoka
CVE-2026-32463
Sync Post With Other Site <= 1.9.3 - Authenticated (Contributor+) Arbitrary File Upload
Średnia
CVE-2026-28571
Contact Form to Chat Apps | Click to Chat to Order – FormyChat <= 2.15.7 - Missing Authorization
Nieoceniona
CVE-2026-74900
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from o
Nieoceniona
CVE-2026-74901
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify
Nieoceniona
CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known de
Nieoceniona
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Nieoceniona
CVE-2026-74894
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload ar
Nieoceniona
CVE-2026-74895
openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to
Nieoceniona
CVE-2026-74896
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use _
Nieoceniona
CVE-2026-74892
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value ca
Nieoceniona
CVE-2026-74899
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python
Nieoceniona
CVE-2026-74885
openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additi
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.