High
CVE-2026-59931
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Medium
CVE-2026-59942
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Medium
CVE-2026-59941
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Medium
CVE-2026-56722
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Low
CVE-2026-55555
Dompdf: File existence oracle via font-face stylesheet declaration
Unrated
CVE-2026-16640
drupal/search_api_autocomplete - SA-CONTRIB-2026-082
Medium
CVE-2026-59882
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Medium
CVE-2026-67354
Guzzle: URI fragments disclosed in redirect Referer headers
Medium
CVE-2026-67355
Guzzle: Host-only cookie scope is not preserved
Medium
CVE-2026-67353
Guzzle: Unbounded response cookies risk denial of service
Medium
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
Medium
ghsa-cvpc-hccg-wmw4
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Critical
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
High
CVE-2026-55578
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
High
CVE-2026-54540
Pheditor has an authenticated terminal command whitelist bypass
Unrated
CVE-2026-15916
Drupal core - SA-CORE-2026-010
Critical
CVE-2026-52881
MantisBT: Reflected XSS in admin/install.php via unescaped printf
Critical
CVE-2026-52847
MantisBT: Reflected XSS in admin/install.php
Medium
CVE-2026-54494
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Medium
CVE-2026-50552
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
High
CVE-2026-54491
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Medium
ghsa-8q6q-m837-fv64
Koel has SSRF through Authenticated Subsonic podcast feed URLs
High
CVE-2026-54493
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Medium
CVE-2026-54492
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.