Medium
CVE-2026-44294
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-44293
protobuf.js: Code injection through bytes field defaults in generated toObject code
Medium
CVE-2026-44292
protobuf.js: Prototype injection in generated message constructors
High
CVE-2026-44291
protobuf.js: Code generation gadget after prototype pollution
High
CVE-2026-44290
protobuf.js: Process-wide denial of service through unsafe option paths
High
CVE-2026-44289
protobuf.js: Denial of service through unbounded protobuf recursion
Medium
CVE-2026-44288
protobufjs has overlong UTF-8 decoding
High
CVE-2026-42290
protobuf.js is Vulnerable to OS Command Injection in the CLI
High
CVE-2026-41712
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
High
CVE-2026-41713
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
High
CVE-2026-1250
Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
Medium
CVE-2025-15463
Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-5371
MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-6177
Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
Medium
CVE-2026-6828
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
High
CVE-2026-4609
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
Medium
CVE-2025-14767
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute
Medium
CVE-2026-42669
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization
Medium
CVE-2026-25431
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.1 - Missing Authorization
Medium
CVE-2026-45217
Payment Gateway of Stripe for WooCommerce <= 5.0.7 - Missing Authorization
Critical
CVE-2026-6433
Custom css-js-php <= 2.0.7 - Unauthenticated Remote Code Execution
Medium
CVE-2026-2515
Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update
Medium
CVE-2026-42725
Checkout Files Upload for WooCommerce <= 2.2.5 - Unauthenticated Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.