Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filtersKunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
drupal/advanced_filesystem - SA-CONTRIB-2026-217
drupal/examples - SA-CONTRIB-2026-215
drupal/freelinking - SA-CONTRIB-2026-213
drupal/easy_breadcrumb - SA-CONTRIB-2026-212
drupal/smartlinker_ai - SA-CONTRIB-2026-210
drupal/menu_link_attributes - SA-CONTRIB-2026-209
drupal/miniorange_2fa - SA-CONTRIB-2026-207
drupal/xray_audit - SA-CONTRIB-2026-206
drupal/leaflet - SA-CONTRIB-2026-204
drupal/inline_formatter_field - SA-CONTRIB-2026-203
drupal/orphans_media - SA-CONTRIB-2026-196
drupal/eca_helper - SA-CONTRIB-2026-193
drupal/block_ajax - SA-CONTRIB-2026-192
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.