Medium
CVE-2026-4071
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-3620
Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter
Medium
CVE-2026-2425
hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter
Medium
CVE-2026-1451
rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter
Medium
CVE-2026-1450
rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter
Medium
CVE-2025-5085
wp-nano-ad <= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter
Medium
CVE-2026-8885
DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-9730
Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-9723
Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
Medium
CVE-2026-9722
Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form
Medium
CVE-2026-9234
JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions
Medium
CVE-2026-9599
Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-8422
Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-8643
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Low
CVE-2026-10532
Logback vulnerable to Object Injection through HardenedObjectInputStream modules
Critical
CVE-2026-8206
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Critical
CVE-2026-47413
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Critical
CVE-2026-47429
When Vitest UI server is listening, arbitrary file can be read and executed
High
CVE-2026-47423
DOMPurify XSS via selectedcontent re-clone
High
CVE-2026-50287
@agenticmail/mcp Missing Authentication for Critical Function
Medium
CVE-2026-10100
Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-3722
Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute
Medium
CVE-2026-49328
Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.