High
CVE-2026-27836
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
High
CVE-2026-26990
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
High
CVE-2026-25497
Craft CMS: GraphQL Asset Mutation Privilege Escalation
High
CVE-2026-25495
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Medium
CVE-2026-25492
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
High
CVE-2026-24416
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
Critical
CVE-2025-69212
OpenSTAManager has an OS Command Injection in P7M File Processing
High
CVE-2025-69215
OpenSTAManager has an SQL Injection in the Stampe Module
High
CVE-2026-25513
FacturaScripts has SQL Injection in API ORDER BY Clause
Medium
CVE-2026-25509
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
High
CVE-2026-23997
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Medium
CVE-2026-23476
FacturaScripts is Vulnerable to Reflected XSS
Medium
CVE-2026-25129
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
High
CVE-2026-22243
EGroupware has SQL Injection in Nextmatch Filter Processing
Medium
CVE-2026-23626
Kimai has an Authenticated Server-Side Template Injection (SSTI)
Medium
CVE-2025-69198
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
Low
ghsa-44jg-mv3h-wj6g
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
Medium
CVE-2026-23495
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
Medium
CVE-2026-23494
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
Unrated
CVE-2026-0948
drupal/social_auth_entra_id - SA-CONTRIB-2026-005
Medium
CVE-2025-61676
October CMS Vulnerable to Stored XSS via Branding Styles
Medium
CVE-2025-61674
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.