High
CVE-2026-55182
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-15446
EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
High
CVE-2026-15780
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Medium
CVE-2026-63643
MagicMirror: ssrf calendar .js
Medium
CVE-2026-63642
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
Low
CVE-2026-63641
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
Low
CVE-2026-61634
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
Medium
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
High
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
High
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
High
CVE-2026-55839
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
High
ghsa-2mf3-mr2r-r4vf
@rhinostone/swig: arbitrary local file read via include/extends path traversal
High
CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Critical
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Medium
CVE-2026-15421
Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
Medium
CVE-2025-11729
PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
Medium
CVE-2026-73377
Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization
High
CVE-2026-73342
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66635
Slider by 10Web – Responsive Image Slider <= 1.2.62 - Cross-Site Request Forgery
High
CVE-2026-73375
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66622
Depicter — Popup & Slider Builder <= 4.8.0 - Unauthenticated SQL Injection
Medium
CVE-2026-73399
Flutterwave WooCommerce <= 3.3.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.