Critical
CVE-2026-27197
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Critical
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
Medium
CVE-2026-0894
Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode
Medium
CVE-2026-2505
Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode
Medium
CVE-2026-43575
OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials
Critical
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
Medium
CVE-2026-0636
Bouncy Castle has an LDAP injection
High
CVE-2026-5598
Bouncy Castle Has Covert Timing Channel Vulnerability
High
CVE-2026-3505
Bouncy Castle Uncontrolled Resource Consumption vulnerability
High
CVE-2026-40458
PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
Medium
CVE-2026-31317
Craftql vulnerable to Server-Side Request Forgery
High
CVE-2026-6518
CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution
Medium
CVE-2026-4801
Page Builder Gutenberg Blocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data
Medium
CVE-2026-6048
Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes
Medium
CVE-2026-1838
Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter
Medium
CVE-2026-1559
Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
High
CVE-2026-2262
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
Medium
CVE-2026-2434
Pz-LinkCard <= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-5718
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
High
CVE-2026-5710
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field
High
CVE-2026-3464
WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
High
CVE-2026-39527
WpStream – Live Streaming, Video on Demand, Pay Per View < 4.11.2 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
a882c3d9-b4c1-4743-b930-382ca1081bab
WowShipping Pro 1.0.6 - Injected Backdoor
Medium
CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.