Medium
CVE-2026-16078
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,415
Medium
CVE-2026-15761
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
Medium
CVE-2026-15906
Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-15827
GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
Medium
CVE-2026-15794
Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
Critical
CVE-2026-14282
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
Medium
CVE-2026-14481
Equalize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter
Critical
CVE-2026-15011
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
Medium
CVE-2026-15404
Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Medium
CVE-2026-15647
Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field
Medium
CVE-2026-15646
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Medium
CVE-2026-9729
Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter
Medium
CVE-2026-9635
WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
High
CVE-2026-12421
ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
Unrated
CVE-2026-15088
drupal/development_environment - SA-CONTRIB-2026-089
Unrated
CVE-2026-16645
drupal/photoswipe - SA-CONTRIB-2026-088
Unrated
CVE-2026-16644
drupal/webform_rest - SA-CONTRIB-2026-087
Medium
CVE-2026-65599
n8n: Google Service Account Private Key Exposed in JWT Header
High
CVE-2026-65592
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
Unrated
CVE-2026-16643
drupal/lunr_filters - SA-CONTRIB-2026-086
Unrated
CVE-2026-16642
drupal/email_login_otp - SA-CONTRIB-2026-085
High
CVE-2026-65597
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Unrated
CVE-2026-16641
drupal/commerce_elavon - SA-CONTRIB-2026-084
High
CVE-2026-65598
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.