High
CVE-2026-2936
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-1233
Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
Medium
CVE-2025-14938
Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload
High
CVE-2026-35042
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
High
CVE-2026-35470
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Low
CVE-2026-34764
Electron: Use-after-free in offscreen shared texture release() callback
Medium
CVE-2026-34217
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Critical
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Medium
CVE-2026-34083
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Medium
CVE-2026-33951
Signal K Server: Unauthenticated Source Priorities Manipulation
Critical
CVE-2026-33950
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Medium
CVE-2026-33709
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links whi
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
High
CVE-2026-5425
Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data
High
CVE-2026-3445
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
Medium
CVE-2026-2826
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
Medium
CVE-2026-2437
WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode
Medium
CVE-2026-2600
ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
High
CVE-2026-4896
WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Medium
CVE-2026-0738
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
Medium
CVE-2026-0737
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
Medium
CVE-2026-0664
Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.