Critical
CVE-2026-25130
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
Low
CVE-2026-25050
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Medium
CVE-2025-15525
Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
Medium
CVE-2026-1431
Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
High
CVE-2024-4027
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
Medium
CVE-2026-24687
Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac
Medium
CVE-2025-15510
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-25394
Fitness FSE <= 1.0.6 - Missing Authorization
Medium
CVE-2026-25020
WP Sync for Notion <= 1.7.0 - Missing Authorization
Medium
CVE-2026-25391
WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 - Missing Authorization
Medium
CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
Medium
CVE-2026-25021
Mizan Demo Importer <= 0.1.3 - Missing Authorization
Medium
CVE-2026-25399
Serious Slider <= 1.2.7 - Missing Authorization
High
CVE-2025-14554
Sell BTC - Cryptocurrency Selling Calculator <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action
Medium
CVE-2026-25395
Business Roy <= 1.1.4 - Missing Authorization
Medium
CVE-2026-1165
Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change
Medium
CVE-2026-25393
Hello FSE <= 1.0.6 - Missing Authorization
Medium
CVE-2026-25019
Atarim <= 4.3.1 - Missing Authorization
Medium
CVE-2026-25392
Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress <= 1.4.1 - Unauthenticated Open Redirect
Critical
CVE-2026-25047
deepHas vulnerable to Prototype Pollution via constructor.prototype
Critical
CVE-2026-40035
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Medium
CVE-2026-24888
Maker.js has Unsafe Property Copying in makerjs.extendObject
High
CVE-2026-23864
React Server Components have multiple Denial of Service Vulnerabilities
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.