High
CVE-2026-21857
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filters
Medium
CVE-2025-68437
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
High
CVE-2026-21447
Bagisto has IDOR in Customer Order Reorder Functionality
High
CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
High
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
Medium
CVE-2025-66306
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
Medium
CVE-2025-66307
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Low
CVE-2025-64711
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Medium
CVE-2025-64714
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
High
CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
High
CVE-2025-64519
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
Medium
ghsa-27c9-vp3w-6ww8
Shopware exposes sensitive user information via CSV export mapping
Low
ghsa-3cpp-fv95-mpr5
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
Medium
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
Medium
CVE-2025-62418
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)
Low
CVE-2025-62412
LibreNMS alert-rules has a Cross-Site Scripting Vulnerability
Low
CVE-2025-61924
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Medium
CVE-2025-62415
bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)
Medium
CVE-2025-61183
VaahCMS is vulnerable to XSS through its Avatar Upload endpoint
High
CVE-2025-59943
phpMyFAQ duplicate email registration allows multiple accounts with the same email
High
CVE-2025-59839
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes
Medium
CVE-2025-51586
Presta Shop vulnerable to email enumeration
Low
CVE-2025-55745
UnoPim has CSV Injection on Quick Export feature
Medium
CVE-2025-55742
UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.