High
CVE-2026-32600
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
High
CVE-2026-32313
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
High
CVE-2026-31889
Shopware vulnerable to a potential take over of app credentials
Medium
CVE-2026-31888
Shopware has user enumeration via distinct error codes on Store API login endpoint
Medium
CVE-2026-31859
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
Medium
CVE-2026-31822
Sylius has a XSS vulnerability in checkout login form
Medium
CVE-2026-31819
Sylius has an Open Redirect via Referer Header
Medium
CVE-2026-31867
Craft Commerce: Potential IDOR in Commerce carts
Low
CVE-2026-29177
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Low
CVE-2026-29113
Craft CMS has a potential information disclosure vulnerability in preview tokens
High
CVE-2026-100857
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Medium
CVE-2026-30927
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Medium
CVE-2026-30885
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
High
CVE-2026-29093
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
High
CVE-2026-29069
Craft CMS has unauthenticated activation email trigger with potential user enumeration
Medium
CVE-2026-28782
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
Critical
CVE-2026-28697
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
High
CVE-2026-28696
Craft CMS has IDOR via GraphQL @parseRefs
Critical
CVE-2026-27012
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Critical
CVE-2026-28508
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.