High
CVE-2026-101906
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
High
CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Critical
ghsa-vcvr-r3jv-pc5j
Next.js: Remote Code Execution in next/og ImageResponse
High
CVE-2026-92245
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
High
ghsa-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
High
CVE-2026-90776
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
Medium
CVE-2026-102397
Ultimate Maps by Supsystic <= 1.5.5 - Missing Authorization
High
CVE-2026-97290
Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94171
CURCY – Multi Currency for WooCommerce 2.2.18 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Medium
CVE-2026-102376
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-102392
Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection
High
CVE-2026-100510
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.14 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-102391
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-100512
Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-97291
Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-102377
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-102375
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Missing Authorization
High
CVE-2026-97265
JetEngine <= 3.8.15.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-97256
Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection
High
CVE-2026-102385
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.