Medium
CVE-2026-2716
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-2714
Institute Management <= 5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Enquiry Form Title' Setting
Critical
CVE-2025-14009
NLTK has a Zip Slip Vulnerability
Critical
CVE-2026-1994
s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-28468
OpenClaw has an authentication bypass in sandbox browser bridge server
High
CVE-2026-28451
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension
High
CVE-2026-29611
OpenClaw has a LFI in BlueBubbles media path handling
Medium
CVE-2026-27486
OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup
Medium
CVE-2026-28477
OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution
High
CVE-2026-27487
OpenClaw: Prevent shell injection in macOS keychain credential write
High
CVE-2026-28462
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes
Medium
CVE-2026-26972
OpenClaw has a Path Traversal in Browser Download Functionality
High
CVE-2025-4521
IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function
Medium
CVE-2026-0556
XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode
Medium
CVE-2025-14851
YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters
High
CVE-2025-14452
WP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
Medium
CVE-2026-0722
Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection
Medium
CVE-2026-0561
Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
Medium
CVE-2025-14427
Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update
Medium
CVE-2025-14342
SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection
Medium
CVE-2025-13930
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Low
CVE-2025-14270
OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update
Medium
CVE-2026-2502
xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'
Medium
CVE-2026-1044
Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.