Medium
CVE-2026-50552
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-58659
PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters
High
CVE-2026-54491
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Medium
ghsa-8q6q-m837-fv64
Koel has SSRF through Authenticated Subsonic podcast feed URLs
High
CVE-2026-54493
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Medium
CVE-2026-54492
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Medium
CVE-2026-49280
MantisBT: REST API unauthorized Issue status change
High
CVE-2026-49273
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
Critical
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
High
CVE-2026-47142
MantisBT: SQL Injection via history_order Configuration Value
Medium
CVE-2026-15458
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
Medium
CVE-2026-15445
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
High
CVE-2026-13042
RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-15306
Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter
Medium
CVE-2026-13005
MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
Medium
CVE-2026-12941
MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
Medium
CVE-2026-15652
Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute
Medium
CVE-2026-15336
Catch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter
Medium
CVE-2026-12434
List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute
Medium
CVE-2026-12409
Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action
Medium
CVE-2026-14987
GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
High
CVE-2026-12753
Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
High
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Medium
CVE-2026-12695
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) < 6.2.6 - Two-Factor Authentication Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.