Medium
CVE-2026-63225
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-61449
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
High
CVE-2026-63126
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Medium
CVE-2026-77360
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
High
CVE-2026-75516
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
Critical
CVE-2026-75513
Marten's LINQ provider has SQL injection via unescaped string literals
High
CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Critical
CVE-2026-63472
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Medium
CVE-2026-63461
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
High
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
High
CVE-2026-63459
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
High
CVE-2026-17086
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
Medium
CVE-2026-15650
RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
Medium
CVE-2026-14855
RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
Medium
CVE-2026-66571
Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Cross-Site Request Forgery
Medium
CVE-2026-66572
JetBlog <= 2.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66573
JetTabs <= 2.3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66574
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66575
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-66576
JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66577
JetSearch <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66578
Property Hive <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66579
JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.