High
CVE-2026-32264
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-32263
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Medium
CVE-2026-32262
Craft CMS has a Path Traversal Vulnerability in AssetsController
High
CVE-2026-32261
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Medium
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Low
CVE-2026-32732
XSS in @leanprover/unicode-input-component
Low
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
High
CVE-2026-29112
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Medium
CVE-2026-4175
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler
Medium
CVE-2026-32774
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
High
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerability
Medium
CVE-2026-2373
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
Critical
CVE-2026-25534
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
High
CVE-2026-32640
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox
High
CVE-2026-2579
WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter
Medium
CVE-2025-53222
tagDiv Opt-In Builder <= 1.7.3 - Reflected Cross-Site Scripting
High
CVE-2026-25464
Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion
High
CVE-2026-24981
Visionary Core <= 1.4.9 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-25469
ViaBill – WooCommerce < 1.1.70 - Missing Authorization to Unauthenticated Settings Change
High
CVE-2026-27045
WooCommerce Infinite Scroll <= 1.6.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-32223
Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-24359
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.