Medium
CVE-2026-103482
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 427
Reset filters
High
CVE-2026-92975
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
High
CVE-2026-104725
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
High
CVE-2026-105318
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39795
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection
High
CVE-2026-41555
Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 - Unauthenticated SQL Injection
Medium
CVE-2026-104385
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure
Medium
CVE-2026-104408
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection
High
CVE-2026-97644
Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
High
CVE-2026-96566
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
Critical
CVE-2026-95588
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Critical
CVE-2026-94389
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution
Medium
CVE-2026-97074
Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-83555
Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization
Medium
CVE-2026-16264
Newsletters <= 4.18.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-91073
Subscribe Forms 1.4.1 - 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-90981
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
Medium
CVE-2026-66619
Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-86824
Newsletter <= 9.3.7 - Unauthenticated Information Exposure
Medium
CVE-2026-86823
Newsletter <= 9.3.6 - Unauthenticated Open Redirect
Medium
CVE-2026-77161
Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
High
CVE-2026-77807
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
Medium
CVE-2026-85310
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.