Critical
CVE-2026-9559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
Critical
CVE-2026-9558
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Medium
CVE-2026-9557
Mautic Focus component Vulnerable to SSRF
High
CVE-2026-4776
Mautic has SQL Injection in API Contact Filtering
Medium
CVE-2026-90935
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
Medium
CVE-2026-90936
Froxlor: Authenticated customers can read other customers' allowed sender aliases
High
CVE-2026-50284
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Medium
CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Medium
CVE-2026-50280
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
High
CVE-2026-50279
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
High
CVE-2026-52854
mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function
Low
CVE-2026-80196
Kimai Password Reset Link Remains Valid After Password Change
High
CVE-2026-49981
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
Medium
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Unrated
CVE-2026-58591
drupal/colorbox - SA-CONTRIB-2026-069
Unrated
CVE-2026-58590
drupal/flowdrop - SA-CONTRIB-2026-068
Unrated
CVE-2026-58589
drupal/flowdrop - SA-CONTRIB-2026-067
Unrated
CVE-2026-58588
drupal/canvas - SA-CONTRIB-2026-066
Unrated
CVE-2026-58587
drupal/canvas - SA-CONTRIB-2026-065
Medium
CVE-2026-55219
Paymenter has race condition in payWithCredit() that enables credit double-spend
Medium
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
High
CVE-2026-47198
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Medium
CVE-2026-54243
Statamic Vulnerable to CSV formula injection in form submission exports
Medium
CVE-2026-54242
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.