High
CVE-2026-50888
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
Critical
CVE-2026-50887
shlink has a Server-Side Request Forgery issue
Medium
CVE-2026-48784
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Medium
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
High
CVE-2026-49742
TYPO3 CMS has Broken Access Control in its Media Module
Medium
ghsa-6jq6-x4cx-qvcm
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
Medium
CVE-2026-53723
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
Medium
CVE-2026-48998
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Critical
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Medium
CVE-2026-47767
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Medium
CVE-2026-47693
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
Medium
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Medium
CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitization
Medium
CVE-2026-48016
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Medium
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Medium
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect target
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Medium
CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
High
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
High
CVE-2026-47696
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
High
CVE-2026-52793
Froxlor's API Authentication bypasses 2FA Authentication
High
CVE-2026-41234
Froxlor: BIND Zone File Injection via TXT Record Content
Unrated
CVE-2026-10770
drupal/cleantalk - SA-CONTRIB-2026-042
Medium
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.