Średnia
CVE-2026-42753
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 71 587
Niska
CVE-2026-42749
Disable Comments & Delete All Comments <= 1.3.0 - Missing Authorization
Średnia
CVE-2026-42750
WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Średnia
CVE-2026-42752
Accept Stripe Payments <= 2.0.98 - Unauthenticated Payment Bypass
Średnia
CVE-2026-42751
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Średnia
ghsa-qp9x-wp8f-qgjj
tuf has platform-dependent delegation path matching
Średnia
CVE-2025-12714
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
Wysoka
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Średnia
CVE-2026-47718
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Średnia
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Średnia
CVE-2026-9189
Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Niska
CVE-2026-46644
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Średnia
CVE-2026-10039
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
Średnia
CVE-2026-44394
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
Średnia
CVE-2026-43000
OpenStack Keystone has an Incorrect Authorization issue
Średnia
CVE-2026-42998
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
Średnia
CVE-2026-42999
OpenStack Keystone has an Authorization Bypass
Wysoka
CVE-2026-6075
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
Średnia
CVE-2026-9243
The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
Wysoka
CVE-2026-44798
Nautobot: GitRepository.current_head field should not be writable through REST API
Wysoka
CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Średnia
CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Średnia
CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
Wysoka
CVE-2025-11262
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.