Medium
CVE-2026-16966
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-14835
SOGO Add Script to Individual Pages Header Footer <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-19722
WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2026-82607
Profile Builder < 3.16.1 - Unauthenticated Limited File Upload
Critical
CVE-2026-15980
MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
Critical
CVE-2026-15369
Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
High
CVE-2026-75807
SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
High
CVE-2026-76586
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation
Medium
CVE-2026-76546
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-77704
Booking for Appointments and Events Calendar – Amelia 1.2.32 - 2.4.8 - Missing Authorization
Low
CVE-2026-77786
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization
Medium
CVE-2026-19430
Catfolders Document Gallery Pro < 2.0.7 - Missing Authorization
Medium
CVE-2026-77007
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
Medium
CVE-2026-80488
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import < 9.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-17522
Newsletters < 4.17 - Cross-Site Request Forgery
Medium
CVE-2026-76547
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-81200
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.42 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2026-16600
SmartAIPress <= 1.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-55855
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
Medium
CVE-2026-55860
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Medium
CVE-2026-55859
org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
Medium
CVE-2026-55858
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context
Medium
CVE-2026-55857
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
Medium
CVE-2026-55856
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.