Medium
CVE-2026-1912
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-1983
SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion
Medium
CVE-2026-1164
Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'
Medium
ghsa-27jp-wm6q-gp25
sqlparse: formatting list of tuples leads to denial of service
Medium
CVE-2025-14067
Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
Medium
CVE-2025-13681
BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter
Medium
CVE-2025-13973
StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure
Medium
CVE-2025-33042
Apache Avro Java SDK is Vulnerable to Code Injection
High
CVE-2025-15157
Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
High
CVE-2026-1844
PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-1841
PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-1721
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Medium
CVE-2026-39636
Livemesh Addons for Elementor <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39635
Grand Magazine <= 3.5.5 - Cross-Site Request Forgery
Medium
CVE-2026-39630
Getty Images <= 4.1.0 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-32350
Chocolate House <= 1.1.5 - Missing Authorization
Medium
CVE-2025-15485
Auto x LINE <= 1.0.0 - Missing Authorization
Medium
CVE-2026-1128
eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion
Medium
CVE-2026-39632
Grand Blog <= 3.1 - Cross-Site Request Forgery
Medium
CVE-2025-14608
WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
Medium
CVE-2026-32351
PowerPress Podcasting <= 11.15.13 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-32353
MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-32352
Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-39637
Mogi <= 1.2.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.