High
CVE-2026-24425
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Critical
CVE-2026-47744
Shopper: Authorization bypass and RBAC privilege escalation in team settings
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Medium
CVE-2026-47745
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Medium
CVE-2026-47742
Shopper: Missing authorization on Product admin Livewire sub-form components
High
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Medium
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Medium
CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitization
Medium
CVE-2026-48016
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Medium
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Medium
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect target
Low
CVE-2026-48011
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Medium
CVE-2026-48010
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Medium
CVE-2026-48009
Shopware: Admin Account Takeover via User Recovery Hash Exposure
Medium
CVE-2026-48008
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Medium
CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
Medium
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
High
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
High
CVE-2026-47696
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
Medium
CVE-2026-47694
WWBN AVideo: Stored XSS via unescaped Gallery category description
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.