Medium
CVE-2026-94672
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-93529
WSP MCP – WordPress MCP – Connect Claude, codex, antigravity or any other AI Agent <= 2.7.0 - Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification
Medium
CVE-2026-94457
Captcha Code <= 3.32 - Unauthenticated Login Captcha Protection Bypass
Medium
CVE-2026-11871
Team Showcase Supreme <= 9.2 - Unauthenticated Information Exposure
Medium
CVE-2026-94077
Safe SVG <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-95514
Netgsm <= 2.10.0 - Missing Authorization
Medium
CVE-2026-96346
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection
Medium
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
High
CVE-2026-77426
Unleash: Missing await on permission check + cross-project IDOR in admin API
Medium
CVE-2026-77425
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
Medium
CVE-2026-76910
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Low
CVE-2026-76909
Unleash: CR-approval email renders user-controlled raw HTML
Medium
CVE-2026-75510
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Medium
CVE-2026-69190
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Medium
CVE-2026-65829
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
High
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
Medium
CVE-2026-63628
mppx: Gas Draining with access list
Medium
CVE-2026-63627
mppx: Gas Draining with padding
High
CVE-2026-63116
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
High
CVE-2026-62985
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
High
CVE-2026-93368
Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
Medium
CVE-2026-6831
Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
Medium
CVE-2026-56682
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
High
CVE-2026-56681
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.