High
CVE-2026-81756
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-19848
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-81764
Email Essentials <= 6.0.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-81293
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection
High
CVE-2026-81768
Super Store Finder <= 7.10 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-81758
OwnerRez <= 1.2.6 - Missing Authorization
Medium
CVE-2026-14567
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure
Medium
CVE-2026-13611
KiviCare – Clinic & Patient Management System (EHR) <= 4.5.4 - Unauthenticated Information Exposure
Medium
CVE-2026-14307
GeotargetingWP < 3.5.6.2 - Reflected Cross-Site Scripting
High
CVE-2026-81765
Tailored Tools <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
Medium
CVE-2026-54732
libreoffice-convert vulnerable to path traversal / arbitrary file write
Medium
CVE-2026-81725
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
Medium
CVE-2026-81727
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
Medium
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
High
CVE-2026-81726
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
Unrated
CVE-2026-81720
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers w
Unrated
CVE-2026-81717
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical
Unrated
CVE-2026-81719
openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compi
Unrated
CVE-2026-81721
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malic
Medium
CVE-2026-81722
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
Unrated
CVE-2026-81715
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sa
Unrated
CVE-2026-81714
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forg
Unrated
CVE-2026-81716
openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed pl
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.