Medium
CVE-2026-12479
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-12481
Keras: Lambda deserialization can bypass safe mode and execute code
Medium
CVE-2026-70480
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
High
CVE-2026-70482
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Low
CVE-2026-12482
Keras: tar extraction permits symlink-based path traversal
Medium
CVE-2026-70481
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
High
CVE-2026-70646
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
Low
CVE-2026-12372
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by re
Medium
CVE-2026-18230
Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-19217
Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-14858
Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure
Critical
CVE-2026-15039
Gift Cards For WooCommerce Pro <= 4.2.9 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-66464
Website Internal Link Optimiser <= 5.2.7 - Missing Authorization
High
CVE-2026-66698
SureDash – Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66471
Accordions – Responsive Accordion & FAQ Plugin for WordPress <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-66687
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-27345
E-cab Taxi Booking Manager for Woocommerce <= 2.0.3 - Missing Authorization
Medium
CVE-2026-66691
Nokri – Job Board WordPress Theme <= 1.6.6 - Missing Authorization
High
CVE-2026-66697
Colissimo shipping methods for WooCommerce <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66462
WooCommerce Appointments <= 5.3.8 - Unauthenticated Information Exposure
Medium
CVE-2026-19050
ProSolution WP Client <= 2.0.8 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-66689
Anti Spam and list cleaner – AcyChecker <= 2.0.0 - Missing Authorization
Critical
CVE-2026-18048
Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion
Medium
CVE-2026-16977
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.