Medium
CVE-2026-14197
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-12231
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
Medium
CVE-2026-15262
Admin Columns for ACF Fields <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-61976
JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure
Medium
CVE-2026-14195
Brizy – Page Builder < 2.8.18 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-14823
Event Tickets and Registration < 5.29.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-15234
Codeless Page Builder <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-13729
Podlove Podcast Publisher < 4.5.3 - Cross-Site Request Forgery
Medium
CVE-2026-61975
JetReviews <= 3.0.1 - Unauthenticated Information Exposure
Medium
CVE-2026-13604
Pixelavo – Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization
Medium
CVE-2026-14822
Event Tickets and Registration < 5.29.0.1 - Missing Authorization
Medium
CVE-2026-54768
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
Medium
CVE-2026-53573
core-geonetwork has an Open Redirect Bypass
High
CVE-2026-53608
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
Low
CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
Critical
CVE-2026-53609
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Medium
CVE-2026-53606
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
High
CVE-2026-16635
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Critical
CVE-2026-15964
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
Medium
CVE-2026-6453
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
Medium
CVE-2026-18344
Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
Medium
CVE-2025-14073
WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
Medium
CVE-2026-15644
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Medium
CVE-2026-17571
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.