Medium
CVE-2026-6251
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-16585
Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter
Medium
CVE-2026-16587
Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function
Medium
CVE-2026-66053
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit
High
CVE-2026-41608
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
High
CVE-2026-43871
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Medium
CVE-2026-59559
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-16603
Content Protector (Passster) <= 4.3.5 - Unauthenticated Category-Locked Content Disclosure
High
CVE-2026-61953
Simple Link Directory Pro <= 15.0.6 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-16546
Wired Impact Volunteer Management <= 2.8.1 - Missing Authorization
Medium
CVE-2026-16613
GDPR Cookie Compliance <= 5.0.0 - Cross-Site Request Forgery
Medium
CVE-2026-14848
Paid Member Subscriptions <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack
Medium
CVE-2026-59560
FundEngine <= 1.7.8 - Missing Authorization
Medium
CVE-2026-14824
Quiz And Survey Master <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-16293
Blubrry PowerPress <= 11.16.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-16942
Custom HTML Pages <= 0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-15256
Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-66473
Xendit Payment <= 7.2.0 - Missing Authorization
Medium
CVE-2026-66445
Open User Map <= 1.4.46 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-16993
DHL for WooCommerce <= 4.0.0 - Unauthenticated Shipping Label Disclosure
Medium
CVE-2026-15671
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
Medium
CVE-2026-16968
GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure
Medium
CVE-2026-16981
DHL for WooCommerce <= 4.0.0 - Insecure Direct Object Reference to Unauthenticated Shipping Label Download
High
CVE-2026-65440
GetGenie <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.