Medium
CVE-2026-3835
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-48798
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
Medium
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Medium
CVE-2026-45694
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
High
CVE-2026-35445
Winter: Authenticated backend users can bypass Users controller permission checks
Medium
CVE-2026-32639
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Medium
CVE-2026-32593
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
High
CVE-2026-32258
Winter: Stored XSS through Editor Settings custom styles
High
CVE-2026-32257
Winter: Stored XSS through Brand Settings custom styles
Medium
CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the
Medium
CVE-2026-73340
Featured Image from URL (FIFU) <= 5.3.3 - Authenticated (Contributor+) Stored Cross-site Scripting
Medium
CVE-2026-61978
Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 - Missing Authorization
Medium
CVE-2026-73344
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-28002
Booktics 1.0.22 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-73353
Revolut Gateway for WooCommerce < 4.22.10 - Missing Authorization
High
CVE-2026-28142
Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
High
CVE-2026-28004
Business Directory <= 6.4.25 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27380
Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-15205
Paymob for WooCommerce <= 4.1.8 - Unauthenticated SQL Injection
High
CVE-2026-18039
Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-73357
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting
High
CVE-2026-28003
Maspik – Spam blacklist <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-73349
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization
High
CVE-2026-28001
Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.