Medium
CVE-2026-15727
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-15324
SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
Unrated
CVE-2026-55805
Drupal core - SA-CORE-2026-012
Unrated
CVE-2026-15917
Drupal core - SA-CORE-2026-011
Medium
CVE-2026-15021
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
Unrated
CVE-2026-15916
Drupal core - SA-CORE-2026-010
Medium
CVE-2026-15106
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
Medium
CVE-2026-15610
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
Medium
CVE-2026-13754
Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
High
CVE-2026-15008
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
Medium
CVE-2026-15651
WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
Medium
CVE-2026-15099
WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
Medium
CVE-2026-15022
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
Medium
CVE-2026-13755
Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
Medium
CVE-2026-15350
The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter
Medium
CVE-2026-13767
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
High
CVE-2026-7543
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
High
CVE-2026-62944
MantisBT: Stored XSS in print_all_bug_page_word.php
Medium
CVE-2026-52883
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Medium
CVE-2026-52882
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Critical
CVE-2026-52881
MantisBT: Reflected XSS in admin/install.php via unescaped printf
Critical
CVE-2026-52847
MantisBT: Reflected XSS in admin/install.php
Medium
CVE-2026-54494
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Medium
CVE-2026-50552
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.