Medium
CVE-2026-35565
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-35337
Apache Storm: Deserialization of Untrusted Data vulnerability
Medium
CVE-2026-6203
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
Critical
CVE-2026-4810
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability
High
CVE-2026-39531
WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection
High
CVE-2026-39530
SpeakOut! Email Petitions <= 4.6.5 - Unauthenticated SQL Injection
Medium
CVE-2026-39513
Easy Appointments <= 3.12.21 - Missing Authorization
High
CVE-2026-39468
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-39463
ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39491
Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-39512
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection
High
CVE-2026-39474
Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-39511
WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection
Medium
CVE-2026-5335
Magic Export & Import <= 1.1.0 - Unauthenticated Information Exposure
High
CVE-2026-39494
Product Filter for WooCommerce by WBW <= 3.1.2 - Unauthenticated SQL Injection
Medium
CVE-2026-39525
Booking Activities <= 1.16.48.1 - Missing Authorization
High
CVE-2019-25710
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
Low
CVE-2026-6125
Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
Medium
CVE-2026-1116
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of
Critical
CVE-2026-5059
aws-mcp has a Command Injection Remote Code Execution Vulnerability
Medium
CVE-2026-5337
Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
High
CVE-2026-41139
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Medium
ghsa-55v6-g8pm-pw4c
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.