Medium
CVE-2026-15663
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,436
High
CVE-2026-15401
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
Medium
CVE-2026-55223
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
Medium
CVE-2026-53669
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
Medium
CVE-2026-53668
React Router: Open redirect leading to XSS
Medium
CVE-2026-53667
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
Medium
CVE-2026-53666
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
Medium
CVE-2026-53467
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
High
CVE-2026-47219
find-my-way: DDoS with HTTP2
Medium
CVE-2026-15346
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter
Medium
CVE-2026-15821
SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-15739
Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
Medium
CVE-2026-12654
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
Medium
CVE-2026-15755
Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-15665
Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute
Medium
CVE-2026-15334
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Medium
CVE-2026-15333
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
Medium
CVE-2026-15648
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Medium
CVE-2026-15653
Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
Medium
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
High
CVE-2026-8789
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
Medium
CVE-2026-45339
Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
High
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.