Medium
CVE-2026-75018
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-74853
Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read
Medium
CVE-2026-85038
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.40 - Unauthenticated Unauthorized B2B Group Assignment
Medium
CVE-2026-17517
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) < 4.5.1.2 - Missing Authorization
Medium
CVE-2026-79631
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure
Medium
CVE-2026-87870
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Medium
CVE-2026-32480
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Missing Authorization
Critical
CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
Medium
CVE-2026-84066
Directorist: AI-Powered Business Directory, Listings & Classified Ads < 8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-12843
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
Medium
CVE-2026-57777
WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection
High
CVE-2026-19224
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2025-15691
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
Medium
CVE-2026-27086
Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-82186
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection
Critical
CVE-2024-33663
python-jose algorithm confusion guard bypassed by DER-encoded public keys
High
CVE-2026-77465
toml-node: Uncontrolled Recursion
High
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
Medium
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Medium
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Medium
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
High
CVE-2026-82404
TOON: Prototype pollution when decoding untrusted TOON input
High
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Critical
CVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.