Medium
CVE-2026-63336
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
High
CVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
High
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
High
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
High
CVE-2026-55839
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
High
ghsa-2mf3-mr2r-r4vf
@rhinostone/swig: arbitrary local file read via include/extends path traversal
High
CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Critical
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Medium
CVE-2026-15421
Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
Medium
CVE-2025-11729
PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
Medium
CVE-2026-73377
Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization
High
CVE-2026-73342
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66635
Slider by 10Web – Responsive Image Slider <= 1.2.62 - Cross-Site Request Forgery
High
CVE-2026-73375
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66622
Depicter — Popup & Slider Builder <= 4.8.0 - Unauthenticated SQL Injection
Medium
CVE-2026-73399
Flutterwave WooCommerce <= 3.3.0 - Missing Authorization
High
CVE-2026-73400
Restaurant Menu and Food Ordering <= 2.4.11 - Unauthenticated Local File Inclusion
High
CVE-2026-73380
Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-66643
Wufoo Shortcode <= 1.55 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66641
Video Conferencing with Zoom <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66638
Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66591
Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66639
WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.