Unrated
CVE-2026-11915
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
Unrated
CVE-2026-11914
drupal/composer - SA-CONTRIB-2026-046
Unrated
CVE-2026-11913
drupal/mothermayi - SA-CONTRIB-2026-045
Unrated
CVE-2026-11909
drupal/examples - SA-CONTRIB-2026-044
Medium
CVE-2026-53675
BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR
High
CVE-2026-53673
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Critical
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Medium
CVE-2026-47767
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
High
CVE-2026-50635
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
Medium
CVE-2026-47693
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
Critical
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
Low
CVE-2026-47730
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Critical
CVE-2026-47744
Shopper: Authorization bypass and RBAC privilege escalation in team settings
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Medium
CVE-2026-47742
Shopper: Missing authorization on Product admin Livewire sub-form components
High
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Medium
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Medium
CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitization
Medium
CVE-2026-48016
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Medium
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Medium
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect target
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.