Medium
CVE-2026-32812
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Medium
CVE-2026-32755
Admidio is Missing CSRF Protection on Role Membership Date Changes
Medium
CVE-2026-32816
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
High
CVE-2026-32756
File Upload(RCE) Vulnerability in admidio
High
CVE-2026-32600
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
High
CVE-2026-32313
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
High
CVE-2026-31889
Shopware vulnerable to a potential take over of app credentials
Medium
CVE-2026-31859
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
Medium
CVE-2026-31825
Sylius has a DQL Injection via API Order Filters
Medium
CVE-2026-31822
Sylius has a XSS vulnerability in checkout login form
High
CVE-2026-29175
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Medium
CVE-2026-30964
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
Medium
CVE-2026-30913
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
High
CVE-2026-100857
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
High
CVE-2025-14675
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-29093
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
Unrated
CVE-2026-3531
drupal/openid_connect - SA-CONTRIB-2026-026
Medium
CVE-2026-28782
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
Medium
CVE-2026-28781
Craft CMS: Entries Authorship Spoofing via Mass Assignment
Critical
CVE-2026-28697
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
High
CVE-2026-28696
Craft CMS has IDOR via GraphQL @parseRefs
Medium
CVE-2026-28695
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.