Medium
CVE-2026-101910
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-88058
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
High
CVE-2026-68497
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Medium
CVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Medium
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
Medium
CVE-2026-101914
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
Medium
CVE-2026-61834
scim-patch: Mutation of Inherited Built-in Method Objects
High
ghsa-456v-xq2p-r4cj
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
High
CVE-2026-96326
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
High
CVE-2026-87741
ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
Medium
CVE-2026-94297
Media Library Organizer 2.0.4 - 2.1.3 - Missing Authorization
Medium
CVE-2026-84740
The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-80333
Solace Extra <= 1.7.1 - Unauthenticated Information Exposure
High
CVE-2026-92994
Verge3D <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-96344
eCommerce Product Catalog <= 3.6.0 - Authenticated (Custom Role+) PHP Object Injection
Medium
CVE-2026-90952
Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Access Mode Bypass
High
CVE-2026-96816
Trusted Shops Easy Integration for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-93651
Minimum and Maximum Quantity for WooCommerce <= 2.1.2 - Authenticated (Author+) PHP Object Injection
High
CVE-2026-85573
All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
High
CVE-2026-94683
DesignSetGo <= 2.8.0 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-96351
Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-96832
Content Egg – Affiliate Product Importer & Price Comparison <= 6.3.1 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2026-85001
EmbedPress 4.4.9 - 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-96831
Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.