Medium
CVE-2026-0859
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Medium
CVE-2026-22242
CoreShop Vulnerable to SQL Injection via Admin Reports
High
CVE-2025-68954
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
High
CVE-2025-68455
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Medium
CVE-2025-68437
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
Medium
CVE-2026-21451
Bagisto has HTML Filter Bypass that Enables Stored XSS
High
CVE-2025-69200
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
Medium
CVE-2025-68951
phpMyFAQ has Stored XSS in user list via admin-managed display_name
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Medium
CVE-2025-66843
Grav is vulnerable to Stored XSS through authenticated user-edited content
Critical
CVE-2025-66844
Grav may be vulnerable to SSRF attack via Twig Templates
High
CVE-2024-58303
FoF Pretty Mail has a server-side template injection vulnerability
High
CVE-2025-67509
Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)
Unrated
CVE-2025-13979
drupal/minisite - SA-CONTRIB-2025-117
Medium
CVE-2025-65657
FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management
High
CVE-2025-66298
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
High
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Medium
CVE-2025-66308
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
High
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
High
CVE-2025-66305
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Medium
CVE-2025-66306
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
Medium
CVE-2025-66302
Grav vulnerable to Path Traversal allowing server files backup
Medium
CVE-2025-66307
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Medium
CVE-2025-66312
Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.