Published vulnerability pages

Website Security Risk Index

Current vulnerabilities, affected platforms, and fix guidance for website owners and developers.

Browse by topic

Security risk categories

46 categories with published guidance

Memory Corruption

409

Browse published Memory Corruption vulnerabilities, affected products, and practical fix guidance.

Authorization Bypass

373

Browse published Authorization Bypass vulnerabilities, affected products, and practical fix guidance.

WordPress

350

Browse published WordPress vulnerabilities, affected products, and practical fix guidance.

Information Disclosure

320

Browse published Information Disclosure vulnerabilities, affected products, and practical fix guidance.

Remote Code Execution

303

Browse published Remote Code Execution vulnerabilities, affected products, and practical fix guidance.

Cross-site Scripting

260

Browse published Cross-site Scripting vulnerabilities, affected products, and practical fix guidance.

Network Security

253

Browse published Network Security vulnerabilities, affected products, and practical fix guidance.

Input Validation

243

Browse published Input Validation vulnerabilities, affected products, and practical fix guidance.

Web Application

239

Browse published Web Application vulnerabilities, affected products, and practical fix guidance.

Windows

216

Browse published Windows vulnerabilities, affected products, and practical fix guidance.

API Security

215

Browse published API Security vulnerabilities, affected products, and practical fix guidance.

Browser

215

Browse published Browser vulnerabilities, affected products, and practical fix guidance.

Denial of Service

215

Browse published Denial of Service vulnerabilities, affected products, and practical fix guidance.

Microsoft

212

Browse published Microsoft vulnerabilities, affected products, and practical fix guidance.

PHP

199

Browse published PHP vulnerabilities, affected products, and practical fix guidance.

Path Traversal

167

Browse published Path Traversal vulnerabilities, affected products, and practical fix guidance.

Authentication Bypass

118

Browse published Authentication Bypass vulnerabilities, affected products, and practical fix guidance.

Arbitrary File Write

116

Browse published Arbitrary File Write vulnerabilities, affected products, and practical fix guidance.

Privilege Escalation

113

Browse published Privilege Escalation vulnerabilities, affected products, and practical fix guidance.

Linux

94

Browse published Linux vulnerabilities, affected products, and practical fix guidance.

DevOps

81

Browse published DevOps vulnerabilities, affected products, and practical fix guidance.

SQL Injection

72

Browse published SQL Injection vulnerabilities, affected products, and practical fix guidance.

Cryptography

68

Browse published Cryptography vulnerabilities, affected products, and practical fix guidance.

SSRF

61

Browse published SSRF vulnerabilities, affected products, and practical fix guidance.

Python

59

Browse published Python vulnerabilities, affected products, and practical fix guidance.

Java

57

Browse published Java vulnerabilities, affected products, and practical fix guidance.

IDOR

56

Browse published IDOR vulnerabilities, affected products, and practical fix guidance.

WooCommerce

53

Browse published WooCommerce vulnerabilities, affected products, and practical fix guidance.

Unsafe Deserialization

51

Browse published Unsafe Deserialization vulnerabilities, affected products, and practical fix guidance.

File Upload

47

Browse published File Upload vulnerabilities, affected products, and practical fix guidance.

npm

44

Browse published npm vulnerabilities, affected products, and practical fix guidance.

Joomla

41

Browse published Joomla vulnerabilities, affected products, and practical fix guidance.

Supply Chain

39

Browse published Supply Chain vulnerabilities, affected products, and practical fix guidance.

Cloud Security

36

Browse published Cloud Security vulnerabilities, affected products, and practical fix guidance.

CSRF

33

Browse published CSRF vulnerabilities, affected products, and practical fix guidance.

Race Condition

31

Browse published Race Condition vulnerabilities, affected products, and practical fix guidance.

PDF Editor

28

Browse published PDF Editor vulnerabilities, affected products, and practical fix guidance.

Industrial Control

27

Browse published Industrial Control vulnerabilities, affected products, and practical fix guidance.

.NET

23

Browse published .NET vulnerabilities, affected products, and practical fix guidance.

File Deletion

23

Browse published File Deletion vulnerabilities, affected products, and practical fix guidance.

Open Redirect

16

Browse published Open Redirect vulnerabilities, affected products, and practical fix guidance.

Node.js

15

Browse published Node.js vulnerabilities, affected products, and practical fix guidance.

SAML

13

Browse published SAML vulnerabilities, affected products, and practical fix guidance.

Virtualization

13

Browse published Virtualization vulnerabilities, affected products, and practical fix guidance.

Drupal

6

Browse published Drupal vulnerabilities, affected products, and practical fix guidance.

Unix Domain Sockets

5

Browse published Unix Domain Sockets vulnerabilities, affected products, and practical fix guidance.

Published security risks

Showing 1–36 of 2230 published risks.

medium

CVE-2026-65470 Fluent Support vulnerability

Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

CVE-2026-65470xss

Updated Jul 24, 2026

critical

CVE-2026-65471 Avada Core vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

CVE-2026-65471csrf

Updated Jul 24, 2026

medium

CVE-2026-65472 Kit (formerly ConvertKit) vulnerability

Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

CVE-2026-65472authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65473 Virtue/Ascend/Pinnacle Toolkit vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

CVE-2026-65473xss

Updated Jul 24, 2026

medium

CVE-2026-65475 Modula Image Gallery vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

CVE-2026-65475wordpressxss

Updated Jul 24, 2026

medium

CVE-2026-65474 Ninja Tables vulnerability

Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

CVE-2026-65474

Updated Jul 24, 2026

medium

CVE-2026-65476 Civi vulnerability

Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

CVE-2026-65476authorization-bypass

Updated Jul 24, 2026

high

CVE-2026-65477 Tonda Core vulnerability

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

CVE-2026-65477path-traversal

Updated Jul 24, 2026

medium

CVE-2026-65478 ListingPro vulnerability

Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

CVE-2026-65478authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65479 Reviewer vulnerability

Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

CVE-2026-65479authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65480 TheGem vulnerability

Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.

CVE-2026-65480xss

Updated Jul 24, 2026

high

CVE-2026-65481 Vino vulnerability

Contributor Local File Inclusion in Vino <= 1.9 versions.

CVE-2026-65481path-traversal

Updated Jul 24, 2026

medium

CVE-2026-65482 LA-Studio Element Kit for Elementor vulnerability

Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

CVE-2026-65482xss

Updated Jul 24, 2026

medium

CVE-2026-65483 HashThemes Demo Importer vulnerability

Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

CVE-2026-65483xss

Updated Jul 24, 2026

medium

CVE-2026-65484 Style Kits vulnerability

Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

CVE-2026-65484authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65485 Content Control vulnerability

Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

CVE-2026-65485authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65487 Photography vulnerability

Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

CVE-2026-65487authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65486 Event post vulnerability

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

CVE-2026-65486authorization-bypass

Updated Jul 24, 2026

high

CVE-2026-65488 LA-Studio Element Kit for Elementor vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

CVE-2026-65488csrf

Updated Jul 24, 2026

medium

CVE-2026-65489 LA-Studio Element Kit for Elementor vulnerability

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

CVE-2026-65489authorization-bypass

Updated Jul 24, 2026

high

CVE-2026-65492 Dokan Pro vulnerability

Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions.

CVE-2026-65492xss

Updated Jul 24, 2026

medium

CVE-2026-65490 Create by Mediavine vulnerability

Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.

CVE-2026-65490

Updated Jul 24, 2026

medium

CVE-2026-65491 Query Wrangler vulnerability

Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

CVE-2026-65491authorization-bypass

Updated Jul 24, 2026

high

CVE-2026-65493 Dokan Pro vulnerability

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

CVE-2026-65493phpunsafe-deserialization

Updated Jul 24, 2026

high

CVE-2026-65497 Complianz vulnerability

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

CVE-2026-65497phpunsafe-deserialization

Updated Jul 24, 2026

high

CVE-2026-65495 Dokan Pro vulnerability

Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

CVE-2026-65495authorization-bypass

Updated Jul 24, 2026

high

CVE-2026-65494 Dokan Pro vulnerability

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

CVE-2026-65494sql-injection

Updated Jul 24, 2026

medium

CVE-2026-65496 Complianz vulnerability

Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

CVE-2026-65496ssrf

Updated Jul 24, 2026

medium

CVE-2026-65498 Complianz vulnerability

Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

CVE-2026-65498

Updated Jul 24, 2026

medium

CVE-2026-65501 Shiptastic for WooCommerce vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

CVE-2026-65501woocommerceidor

Updated Jul 24, 2026

high

CVE-2026-65500 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

CVE-2026-65500wordpressauthorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65499 PeproDev Ultimate Invoice vulnerability

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVE-2026-65499authorization-bypass

Updated Jul 24, 2026

medium

CVE-2026-65505 Ultimate Store Kit Elementor Addons vulnerability

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

CVE-2026-65505

Updated Jul 24, 2026

medium

CVE-2026-65503 Ultimate Store Kit Elementor Addons vulnerability

Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

CVE-2026-65503xss

Updated Jul 24, 2026

medium

CVE-2026-65506 MP3 Audio Player for Music, Radio & Podcast by Sonaar vulnerability

Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

CVE-2026-65506authorization-bypass

Updated Jul 24, 2026

high

CVE-2026-65510 PeproDev Ultimate Invoice vulnerability

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVE-2026-65510xss

Updated Jul 24, 2026