Critical
CVE-2026-62682
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-72717
Orval: Import-time RCE via schema default -> zod module-level template literal
Critical
CVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
Critical
CVE-2026-71871
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Critical
CVE-2026-71867
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Critical
CVE-2026-15354
ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Critical
CVE-2026-71868
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
High
CVE-2026-61556
LiquidJS has an infinite loop vulnerability in its `strip_html` filter
High
CVE-2026-62188
OpenClaw Feishu permission tools could ignore per-account disablement
High
CVE-2026-62187
OpenClaw Feishu tools could ignore per-account disablement
Critical
CVE-2026-11613
Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Medium
CVE-2026-73846
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Low
CVE-2026-73844
CKAN MCP Server: Information disclosure via verbose error reflection
Medium
f72c0a27-9602-4465-a14a-15c2a34e578b
Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
High
CVE-2026-84768
VikAppointments Services Booking Calendar <= 1.2.20 - Unauthenticated SQL Injection
Medium
CVE-2026-85303
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation
Medium
CVE-2026-85302
WPKoi Templates for Elementor <= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
eda9ae01-cdc4-43e0-8a4c-1ec365939fa8
Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
Medium
CVE-2026-84767
Bookit — Booking & Appointment Calendar <= 2.6.0.3 - Missing Authorization
Medium
CVE-2026-82024
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting
Medium
CVE-2026-84755
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.