Medium
CVE-2026-61612
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-58272
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Medium
CVE-2026-58270
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
High
CVE-2026-58269
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Medium
CVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
High
CVE-2026-61647
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
Medium
CVE-2026-95586
Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-88848
MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment
Medium
CVE-2026-88847
MasterStudy LMS <= 3.7.49 - Missing Authorization
Medium
CVE-2026-93343
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
Medium
CVE-2026-93342
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
Medium
CVE-2026-80514
wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion
Medium
CVE-2026-94079
WP User Manager – User Profile Builder & Membership <= 2.9.19 - Missing Authorization
Medium
CVE-2026-82195
10Web Booster <= 2.33.0 - Missing Authorization
Medium
CVE-2026-82850
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-93344
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
Medium
CVE-2026-84151
The Post Grid <= 7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
Exploited in attacks
CVE-2026-87902
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
Medium
CVE-2026-74991
WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization
Medium
CVE-2026-89002
WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-93661
Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference
High
CVE-2026-80513
wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-91827
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-82849
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.