Unrated
841
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-27128
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Medium
CVE-2026-27126
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Medium
CVE-2026-25545
Astro has Full-Read SSRF in error rendering via Host: header injection
High
CVE-2025-70058
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent
Critical
CVE-2026-23552
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
High
CVE-2026-25747
Apache Camel Deserializes Untrusted Data in its LevelDB Component
Medium
CVE-2026-27396
Directory Pro <= 2.5.6 - Missing Authorization
High
CVE-2026-27439
Dentario <= 1.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39687
Rapid Car Check Vehicle Data <= 2.1.2 - Missing Authorization
High
CVE-2026-27413
Profile Builder Pro < 3.14.0 - Unauthenticated SQL Injection
Medium
CVE-2026-39690
Author Avatars List/Block <= 2.1.25 - Missing Authorization
Medium
CVE-2026-27386
DesignThemes Directory Addon <= 1.8 - Missing Authorization
High
CVE-2026-27438
Kingler <= 1.7 - Unauthenticated PHP Object Injection
Medium
CVE-2026-23546
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.4 - Authenticated (Subscriber+) Sensitive Data Exposure
High
CVE-2026-22443
Alliance <= 3.1.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27388
DesignThemes Booking Manager <= 2.0 - Missing Authorization
Medium
CVE-2026-27411
SiteGuard WP Plugin <= 1.7.9 - Missing Authorization
High
CVE-2026-27437
Tennis SportClub - Tennis Sports Events WordPress Theme <= 1.2.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-32410
WBW Currency Switcher for WooCommerce <= 2.2.5 - Missing Authorization
Critical
CVE-2026-27389
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authentication Bypass
Medium
CVE-2026-39688
Frontend Profile <= 1.3.9 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.