Medium
CVE-2026-86311
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-89064
All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
High
CVE-2026-81192
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
Critical
CVE-2026-61560
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Medium
CVE-2026-92465
WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-86792
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist,
Medium
CVE-2026-88798
Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth
Medium
CVE-2026-90978
Filter Gallery <= 1.1.4 - Missing Authorization
High
CVE-2026-84738
AF Companion <= 2.1.0 - Authenticated (Shop Manager+) Remote Code Execution
Medium
CVE-2026-16557
Nimble Builder <= 3.3.8 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-86800
Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Login Protection Bypass
High
CVE-2026-85122
Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-84902
King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-88993
All Bootstrap Blocks <= 1.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-90976
Clean Login <= 1.18 - Unauthenticated Account Registration
Medium
CVE-2026-89030
Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Missing Authorization
Medium
CVE-2026-85350
UpsellWP <= 2.2.9 - Unauthenticated Payment Bypass
High
CVE-2026-88824
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-86796
Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Protection Mechanism Bypass
High
CVE-2026-87771
Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection
Medium
CVE-2026-85010
RestroPress <= 3.4.5 - Unauthenticated Payment Bypass
High
CVE-2026-87770
Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection
Medium
CVE-2026-87966
Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-85009
RestroPress < 3.4.8 - Unauthenticated Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.