Medium
CVE-2026-42753
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Low
CVE-2026-42749
Disable Comments & Delete All Comments <= 1.3.0 - Missing Authorization
Medium
CVE-2026-42750
WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42752
Accept Stripe Payments <= 2.0.98 - Unauthenticated Payment Bypass
Medium
CVE-2026-42751
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
ghsa-qp9x-wp8f-qgjj
tuf has platform-dependent delegation path matching
Medium
CVE-2025-12714
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
High
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Medium
CVE-2026-47718
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Medium
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Medium
CVE-2026-9189
Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Low
CVE-2026-46644
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Medium
CVE-2026-10039
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
Medium
CVE-2026-44394
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
Medium
CVE-2026-43000
OpenStack Keystone has an Incorrect Authorization issue
Medium
CVE-2026-42998
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
Medium
CVE-2026-42999
OpenStack Keystone has an Authorization Bypass
High
CVE-2026-6075
Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
Medium
CVE-2026-9243
The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
High
CVE-2026-44798
Nautobot: GitRepository.current_head field should not be writable through REST API
High
CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Medium
CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Medium
CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
High
CVE-2025-11262
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.