Medium
CVE-2026-11571
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,583
Medium
CVE-2026-54835
Five Star Restaurant Menu and Food Ordering <= 2.5.2 - Missing Authorization
Medium
CVE-2026-56007
Ocean Product Sharing <= 2.2.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Critical
CVE-2026-54833
Enable CORS <= 2.0.3 - Backdoor
Medium
CVE-2026-56024
WP Easy Pay – Payment and Donation form Builder for Square <= 4.5.0 - Cross-Site Request Forgery
Medium
CVE-2026-54846
Syncee Premium Dropshipping & Wholesale <= 1.0.27 - Missing Authorization
Medium
CVE-2026-56012
Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-11869
DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Information Disclosure
Medium
CVE-2026-54848
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.3 - Unauthenticated Information Exposure
High
CVE-2026-11407
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Medium
CVE-2026-48817
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Medium
CVE-2026-2021
Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute
Medium
CVE-2026-8039
Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-48818
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Unrated
CVE-2026-55808
Drupal core - SA-CORE-2026-009
Unrated
CVE-2026-55807
Drupal core - SA-CORE-2026-008
Unrated
CVE-2026-55806
Drupal core - SA-CORE-2026-007
Unrated
CVE-2026-55804
Drupal core - SA-CORE-2026-006
Unrated
CVE-2026-55803
Drupal core - SA-CORE-2026-005
Medium
CVE-2026-55590
CakePHP Authentication: Open redirect weakness via backslash bypass
Critical
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
High
CVE-2026-55470
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
High
CVE-2026-55760
handlebars.java FileTemplateLoader Path Traversal
High
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.