High
CVE-2026-54593
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
High
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
High
CVE-2026-45293
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
High
ghsa-cmwh-g2h8-c222
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
High
ghsa-rm67-g9ch-vxff
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own
High
ghsa-h4hf-v6w5-897x
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
Critical
ghsa-f25v-x6vr-962g
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
High
ghsa-g3hq-hphg-8fhh
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
High
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
High
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
High
CVE-2026-59931
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Medium
CVE-2026-59943
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Medium
CVE-2026-59942
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Medium
CVE-2026-59941
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Medium
CVE-2026-56722
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Low
CVE-2026-55555
Dompdf: File existence oracle via font-face stylesheet declaration
Low
CVE-2026-55554
Dompdf: Chroot Validation Bypass
Unrated
CVE-2026-15088
drupal/development_environment - SA-CONTRIB-2026-089
Unrated
CVE-2026-16643
drupal/lunr_filters - SA-CONTRIB-2026-086
Unrated
CVE-2026-16642
drupal/email_login_otp - SA-CONTRIB-2026-085
Unrated
CVE-2026-16641
drupal/commerce_elavon - SA-CONTRIB-2026-084
Unrated
CVE-2026-16639
drupal/i18n_sso - SA-CONTRIB-2026-081
Medium
CVE-2026-59882
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Medium
CVE-2026-67354
Guzzle: URI fragments disclosed in redirect Referer headers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.