Medium
CVE-2026-0815
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-1821
Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-1786
Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update
Critical
CVE-2026-21531
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
Critical
CVE-2026-1774
CASL Ability is Vulnerable to Prototype Pollution
Critical
CVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-1893
Orbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute
Medium
CVE-2026-56294
cap-go/capacitor-native-biometric Authentication Bypass
Medium
CVE-2026-1231
Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings
Medium
CVE-2025-13431
SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter
Low
CVE-2026-23901
Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability
Medium
CVE-2025-11537
Keycloak logs sensitive headers
Critical
CVE-2026-23906
Apache Druid Vulnerable to Authentication Bypass
Medium
CVE-2025-15524
Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
High
CVE-2025-14541
Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
Medium
CVE-2026-25957
Cube Core is vulnerable to Denial of Service (DoS) via crafted request
High
CVE-2026-25958
Cube Core is vulnerable to privilege escalation via a specially crafted request
High
CVE-2026-25951
FUXA Affected by a Path Traversal Sanitization Bypass
Critical
CVE-2026-25939
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Critical
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Medium
ghsa-8grv-jq2g-cfhw
amphp/http-server affected by HTTP/2 DDoS vulnerability
Medium
CVE-2026-25918
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
High
CVE-2026-25892
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.