Medium
CVE-2026-28080
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-48093
Password only login <= 0.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-9544
Doppler Forms = 2.5.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Critical
CVE-2025-61778
Akka.Remote TLS did not properly implement certificate-based authentication
Low
CVE-2025-61670
Wasmtime: Memory leak in C API with `externref` and `anyref` types
Medium
CVE-2025-11171
Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
High
CVE-2025-11204
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2025-10494
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-10587
Community Events <= 1.5.1 - Unauthenticated SQL Injection
Medium
CVE-2025-13033
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
High
CVE-2025-11362
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding
Medium
CVE-2025-43824
Liferay Profile Widget does not prevent vCard extension spoofing
Medium
CVE-2025-62933
Awesome Testimonials <= 2.2.1 - Cross-Site Request Forgery
High
CVE-2025-59550
Xcare < 6.5 - Unauthenticated Local File Inclusion
Medium
CVE-2025-62934
WP Business Hours <= 1.4 - Cross-Site Request Forgery
High
CVE-2025-58952
Neuronet < 1.14.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-48099
Search & Filter <= 1.2.17 - Cross-Site Request Forgery
Medium
CVE-2025-10649
Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie
Critical
CVE-2025-59159
SillyTavern Web Interface Vulnerable DNS Rebinding
Critical
CVE-2025-52472
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
Critical
CVE-2025-49594
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Critical
CVE-2025-55346
Flowise vulnerable to RCE via Dynamic function constructor injection
Low
CVE-2025-11322
NovoSGA: Manipulation of User Creation Page can lead to weak password requirements
Medium
CVE-2025-12475
Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.