High
CVE-2026-31820
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-31819
Sylius has an Open Redirect via Referer Header
High
CVE-2025-56421
LimeSurvey is vulnerable to SQL injection
Medium
CVE-2026-31867
Craft Commerce: Potential IDOR in Commerce carts
Low
CVE-2026-29177
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Medium
CVE-2026-29176
Craft Commerce has stored XSS in Inventory Location Name
High
CVE-2026-29175
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Low
CVE-2026-29173
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Low
CVE-2026-29113
Craft CMS has a potential information disclosure vulnerability in preview tokens
Medium
CVE-2026-30964
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
Medium
CVE-2026-30913
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
High
CVE-2026-100857
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Medium
CVE-2026-30927
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Medium
CVE-2026-30885
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
Medium
ghsa-5q8v-j673-m5v4
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
Medium
CVE-2026-30838
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
High
CVE-2025-14675
Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2025-15602
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Medium
ghsa-7rhv-h82h-vpjh
EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface
Medium
ghsa-qrfh-cc86-vc8c
Leantime has HTML injection through firstname and lastname fields
High
CVE-2026-29093
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
High
CVE-2026-29069
Craft CMS has unauthenticated activation email trigger with potential user enumeration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.