Medium
CVE-2026-28685
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Unrated
CVE-2026-3532
drupal/openid_connect - SA-CONTRIB-2026-027
Unrated
CVE-2026-3531
drupal/openid_connect - SA-CONTRIB-2026-026
Unrated
CVE-2026-3530
drupal/openid_connect - SA-CONTRIB-2026-025
Unrated
CVE-2026-3529
drupal/ga4_google_analytics - SA-CONTRIB-2026-024
Unrated
CVE-2026-3528
drupal/calculation_fields - SA-CONTRIB-2026-023
Unrated
CVE-2026-3527
drupal/ajax_dashboard - SA-CONTRIB-2026-022
Unrated
CVE-2026-3526
drupal/file_access_fix - SA-CONTRIB-2026-021
Unrated
CVE-2026-3525
drupal/file_access_fix - SA-CONTRIB-2026-020
Medium
CVE-2026-3242
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Medium
CVE-2026-3241
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Medium
CVE-2026-3244
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Low
CVE-2026-2994
Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)
High
CVE-2026-3452
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection
Medium
CVE-2026-3240
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Medium
CVE-2026-28784
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
Medium
CVE-2026-28782
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
Medium
CVE-2026-28783
Craft CMS has Twig Function Blocklist Bypass
Medium
CVE-2026-28781
Craft CMS: Entries Authorship Spoofing via Mass Assignment
Critical
CVE-2026-28697
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Low
CVE-2026-56393
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
High
CVE-2026-28696
Craft CMS has IDOR via GraphQL @parseRefs
Medium
CVE-2026-28695
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Critical
CVE-2026-29058
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.