Low
CVE-2026-66011
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
ghsa-p498-v437-472g
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
High
CVE-2026-73231
Faker: helpers.fake exploitable into arbritary code execution
Medium
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege esca
Medium
CVE-2026-84044
Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Forged Payment Completion
Medium
CVE-2026-15232
MotoPress Appointment Booking < 2.4.8 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-81198
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2025-15663
Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-19704
Comments – wpDiscuz < 7.6.66 - Unauthenticated SQL Injection
Medium
CVE-2026-81426
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Cross-Site Request Forgery
High
CVE-2026-84775
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Denial of Service
Medium
CVE-2025-15664
Ultimate Before After Image Slider & Gallery – BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-81195
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Missing Authorization
High
CVE-2026-84763
RTMKit <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-84238
YITH Request a Quote for WooCommerce Premium < 4.46.0 - Missing Authorization
High
CVE-2026-84765
Breadcrumb NavXT <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-84776
MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall <= 6.69 - Unauthenticated Denial of Service
Medium
CVE-2026-77785
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Authenticated (Author+) Information Exposure
Medium
CVE-2026-84770
Mang Board WP <= 2.3.8 - Cross-Site Request Forgery
High
CVE-2026-81295
Under Construction <= 5.82 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-84043
ePayco plugin for WooCommerce < 8.4.7 - Unauthenticated Unauthorized Order Status Manipulation
Medium
CVE-2026-81282
Product Variations Swatches for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-84813
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection
High
CVE-2026-84778
Migrate Guru – Site Migration & Cloning <= 6.65 - Unauthenticated Denial of Service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.