Medium
CVE-2026-39631
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2026-2446
Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update
High
CVE-2026-42641
Share This Image <= 2.14 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-39634
Grand Portfolio <= 3.3 - Cross-Site Request Forgery
Medium
CVE-2026-39633
Grand Car Rental <= 3.6.9 - Cross-Site Request Forgery
Critical
CVE-2025-69633
Improper neutralization of SQL parameters in Advanced Popup Creator module from Idnovate for PrestaShop
Medium
CVE-2019-25338
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames t
Medium
CVE-2026-26185
Directus Vulnerable to User Enumeration via Password Reset Timing Attack
High
CVE-2026-61701
MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
Medium
CVE-2025-56647
@farmfe/core is Missing Origin Validation in WebSocket
High
CVE-2026-26063
CediPay Affected by Improper Input Validation in Payment Processing
Low
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
Critical
CVE-2026-26217
Crawl4AI Has Local File Inclusion in Docker API via file:// URLs
Critical
CVE-2026-26216
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
Medium
CVE-2026-26000
XWiki vulnerable to click-jacking through CSS injection in comments
Medium
CVE-2026-2327
markdown-it is has a Regular Expression Denial of Service (ReDoS)
High
CVE-2026-0969
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
High
CVE-2026-1320
Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
High
CVE-2026-1316
Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
Medium
CVE-2026-39629
Uminex <= 1.0.9 - Unauthenticated Arbitrary Shortcode Execution
Critical
CVE-2026-2418
Login with Salesforce <= 1.0.2 - Authentication Bypass
Medium
CVE-2026-25036
Passster <= 4.2.25 - Missing Authorization
Medium
CVE-2026-39627
Ashe <= 2.267 - Missing Authorization
Medium
CVE-2026-39575
Custom Query Blocks <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.