Critical
CVE-2026-61444
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,406
Medium
CVE-2026-61441
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
High
CVE-2026-61436
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
High
CVE-2026-61428
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
High
CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Medium
CVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
High
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Medium
CVE-2026-46437
wger: API credentials remain valid after logout/password change
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Medium
CVE-2026-42708
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-42710
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Authenticated (Author+) SQL Injection
High
CVE-2026-82627
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Medium
CVE-2026-17538
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Medium
CVE-2026-94154
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Medium
CVE-2026-42713
Post title marquee scroll <= 9.9 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-42714
Pix por Piggly (para Woocommerce) <= 2.1.2 - Authenticated (Shop Manager+) SQL Injection
Medium
CVE-2026-42720
Dynamic User Directory <= 2.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-42721
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-27434
WP Rentals - Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
Medium
CVE-2026-104390
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Missing Authorization
Medium
CVE-2026-105876
Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 - Unauthenticated Information Exposure
Medium
CVE-2026-104393
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-105875
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.