High
CVE-2026-42762
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-48865
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting
High
CVE-2026-48871
MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-8382
Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
High
CVE-2026-42754
Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42760
Backup and Staging by WP Time Capsule <= 1.22.25 - Missing Authorization
High
CVE-2026-42757
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-42755
TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Unauthenticated SQL Injection
Critical
CVE-2026-42758
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation
High
CVE-2026-42759
Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Critical
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Critical
CVE-2026-47407
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Critical
CVE-2026-47392
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Critical
CVE-2026-47396
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
High
CVE-2026-47398
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
High
CVE-2026-47266
formie's unauthenticated front-end submission editing can overwrite existing submissions
Critical
CVE-2026-76242
stigmem-node's federation peer registration lacked explicit out-of-band approval
High
CVE-2026-76241
stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment
Critical
CVE-2026-76244
stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation
High
CVE-2026-76240
stigmem-node's Postgres schema identifier handling required defensive quoting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.