High
CVE-2026-39800
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,415
High
CVE-2026-105436
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-42633
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-40800
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-42702
Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting
High
4a3e3e6e-9c17-4ac5-9f83-1e01365436e9
WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
High
CVE-2026-39799
WP File Download <= 6.3.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42630
Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure
Medium
CVE-2026-42419
Swish Migrate and Backup <= 1.4.0 - Unauthenticated Information Exposure
Medium
CVE-2026-40777
wpsection <= 1.5.1 - Missing Authorization
Medium
CVE-2026-42695
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-102598
Werkzeug safe_join() allows Windows special device names
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
Critical
CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-96749
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
High
CVE-2026-96748
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Medium
CVE-2026-96747
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
High
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Medium
CVE-2026-104181
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105760
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.