High
CVE-2026-12421
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,426
Unrated
CVE-2026-15088
drupal/development_environment - SA-CONTRIB-2026-089
Unrated
CVE-2026-16645
drupal/photoswipe - SA-CONTRIB-2026-088
Unrated
CVE-2026-16644
drupal/webform_rest - SA-CONTRIB-2026-087
Medium
CVE-2026-65599
n8n: Google Service Account Private Key Exposed in JWT Header
High
CVE-2026-65592
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
Unrated
CVE-2026-16643
drupal/lunr_filters - SA-CONTRIB-2026-086
Unrated
CVE-2026-16642
drupal/email_login_otp - SA-CONTRIB-2026-085
High
CVE-2026-65597
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Unrated
CVE-2026-16641
drupal/commerce_elavon - SA-CONTRIB-2026-084
High
CVE-2026-65598
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
High
CVE-2026-65015
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
Unrated
CVE-2026-16640
drupal/search_api_autocomplete - SA-CONTRIB-2026-082
Unrated
CVE-2026-16639
drupal/i18n_sso - SA-CONTRIB-2026-081
Unrated
CVE-2026-16638
drupal/media_folders - SA-CONTRIB-2026-080
High
CVE-2026-9713
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
High
CVE-2026-7534
SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
High
CVE-2026-7232
FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
Medium
CVE-2026-45820
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
Medium
CVE-2026-27391
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
Medium
CVE-2026-65488
LA-Studio Element Kit for Elementor <= 1.6.2 - Cross-Site Request Forgery
Medium
CVE-2026-65457
ЮKassa для WooCommerce <= 2.16.1 - Missing Authorization
High
CVE-2026-65466
JetBooking <= 4.1.2 - Authenticated (Custom+) Server-Side Request Forgery
Medium
CVE-2026-65471
Avada Core <= 5.15.6 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.