Medium
CVE-2026-34364
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-34363
LiveQuery protected field leak via shared mutable state across concurrent subscribers
Medium
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Medium
CVE-2026-34237
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Critical
CVE-2026-34361
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Medium
CVE-2026-34360
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
High
CVE-2026-34359
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Critical
CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
High
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Medium
CVE-2026-1877
Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
Medium
CVE-2026-1834
Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Medium
CVE-2026-1797
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
Medium
CVE-2026-1710
WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
Medium
CVE-2026-4146
Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter
Medium
CVE-2026-4020
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Critical
CVE-2026-3300
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
High
CVE-2026-5130
Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
Critical
CVE-2026-4257
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
Medium
CVE-2026-45214
Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-15433
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Critical
CVE-2025-15488
Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
Critical
CVE-2026-1969
ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.