High
CVE-2026-53599
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-68501
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
High
CVE-2026-68500
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
Unrated
CVE-2026-18260
drupal/disable_login - SA-CONTRIB-2026-110
Unrated
CVE-2026-18259
drupal/tca - SA-CONTRIB-2026-090
Low
CVE-2026-52838
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
Low
CVE-2026-52841
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
Medium
CVE-2026-52837
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Low
CVE-2026-52839
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
Low
CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
High
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Critical
CVE-2026-54588
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
High
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
High
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
High
CVE-2026-45293
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
High
CVE-2026-43871
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
High
ghsa-cmwh-g2h8-c222
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
High
ghsa-rm67-g9ch-vxff
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own
High
ghsa-h4hf-v6w5-897x
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
Critical
ghsa-f25v-x6vr-962g
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
High
ghsa-g3hq-hphg-8fhh
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
High
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
High
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
High
CVE-2026-59931
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.