Medium
CVE-2026-59943
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-59942
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Medium
CVE-2026-59941
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Medium
CVE-2026-56722
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Low
CVE-2026-55555
Dompdf: File existence oracle via font-face stylesheet declaration
Low
CVE-2026-55554
Dompdf: Chroot Validation Bypass
Unrated
CVE-2026-15088
drupal/development_environment - SA-CONTRIB-2026-089
Unrated
CVE-2026-16645
drupal/photoswipe - SA-CONTRIB-2026-088
Unrated
CVE-2026-16644
drupal/webform_rest - SA-CONTRIB-2026-087
Unrated
CVE-2026-16643
drupal/lunr_filters - SA-CONTRIB-2026-086
Unrated
CVE-2026-16642
drupal/email_login_otp - SA-CONTRIB-2026-085
Unrated
CVE-2026-16641
drupal/commerce_elavon - SA-CONTRIB-2026-084
Unrated
CVE-2026-16640
drupal/search_api_autocomplete - SA-CONTRIB-2026-082
Unrated
CVE-2026-16639
drupal/i18n_sso - SA-CONTRIB-2026-081
Unrated
CVE-2026-16638
drupal/media_folders - SA-CONTRIB-2026-080
Medium
CVE-2026-59882
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Medium
CVE-2026-67354
Guzzle: URI fragments disclosed in redirect Referer headers
Medium
CVE-2026-67355
Guzzle: Host-only cookie scope is not preserved
Medium
CVE-2026-67353
Guzzle: Unbounded response cookies risk denial of service
Medium
CVE-2026-59883
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Medium
CVE-2026-59946
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Medium
CVE-2026-59947
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Medium
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
High
CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious transitive package name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.