Medium
CVE-2026-3426
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-4607
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
High
CVE-2026-7635
coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
Medium
CVE-2026-4608
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
High
CVE-2026-3425
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
Medium
CVE-2026-42726
AWP Classifieds <= 4.4.5 - Missing Authorization
Medium
CVE-2026-45209
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce <= 2.161 - Missing Authorization
Medium
CVE-2026-42670
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.14 - Missing Authorization
High
CVE-2026-45216
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management <= 8.85.0 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
Medium
CVE-2026-45222
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json
Medium
CVE-2026-6813
Continually <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter
Medium
CVE-2026-6800
FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-1934
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
High
CVE-2026-44657
MantisBT Vulnerable to Stored XSS in File Download
High
CVE-2026-44655
MantisBT has Stored XSS on Move Attachments Admin Page
High
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Critical
CVE-2026-43898
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
High
CVE-2026-42071
MantisBT has a Private Bugnote Attachment Content Leak via REST API
Medium
CVE-2026-42070
MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
Medium
CVE-2026-41897
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
Medium
CVE-2026-41159
Mermaid: Improper sanitization of configuration leads to CSS injection
Medium
CVE-2026-41150
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Medium
CVE-2026-41149
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.