medium4.3
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
348 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.3
high8.1
CVE-2026-62989
Shopper: missing variant-delete authorization permits destructive single and bulk actions
shopperlabs · shopper
high8.1
CVE-2026-62967
ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
sinamics · ztnet
high7.1
CVE-2026-119337
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
infiniflow · ragflow
medium6.8
CVE-2026-116248
pgAdmin 4: Non-administrators can share a server with every user
pgadmin.org · pgAdmin 4
high8.2
CVE-2026-116245
pgAdmin 4: Connection services are not restricted in server mode
pgadmin.org · pgAdmin 4
high7.1
critical9.8
CVE-2026-78403
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
Thalesgroup · Sentinel Keys Server
high7.5
CVE-2026-116862
WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
Acato · WP REST Cache
medium6.5
CVE-2026-116853
WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability
Nexcess · GiveWP
medium6.5
CVE-2026-116410
WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability
masteriyo · Masteriyo - LMS
high7.5
CVE-2026-116401
WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
RealMag777 · HUSKY
medium6.5
CVE-2026-54850
WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability
magepeopleteam · Booking and Rental Manager
high8.2
CVE-2026-62162
Hydra: Deposit Claim omits Head state-token spending requirement
cardano-scaling · hydra
medium5.3
CVE-2026-62056
WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability
WP ManageNinja LLC · Fluent CRM
medium4.3
CVE-2026-62023
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability
Unlimited Elements · Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
medium4.3
CVE-2026-62019
WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability
Liquid Web / StellarWP · BookIt
medium4.3
CVE-2026-104674
WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
Arraytics · Booktics
medium4.3
CVE-2026-62047
WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
Liquid Web / StellarWP · Event Tickets
medium5.3
CVE-2026-62122
WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
Arraytics · Booktics
medium6.9
CVE-2026-119763
changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
thechangelog · changelog.com
medium4.3
CVE-2026-109592
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
wordpressdotorg · OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
high7.5
CVE-2026-107630
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
saadiqbal · Email Templates Customizer and Designer for WordPress and WooCommerce
medium6.5
CVE-2026-13747
Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
tigroumeow · Meow Gallery
critical10.0
CVE-2026-61826
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
morpheus65535 · bazarr
medium5.3
medium5.3
medium4.3
CVE-2026-62055
WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
Liquid Web / StellarWP · Event Tickets
medium5.4
CVE-2026-119367
WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability
Liquid Web / StellarWP · The Events Calendar