Medium
CVE-2025-67851
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2025-70958
Subrion CMS vulnerable to cross-site scripting
Medium
CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Medium
CVE-2026-25522
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25490
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Medium
CVE-2026-25489
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
Medium
CVE-2026-25488
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25487
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
Medium
CVE-2026-25486
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
Medium
CVE-2026-25485
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25484
Craft Commerce has Stored XSS in Product Type Name
Medium
CVE-2026-25483
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Medium
CVE-2026-25482
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Critical
CVE-2026-25510
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Medium
CVE-2026-25509
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
High
CVE-2026-23997
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Medium
CVE-2026-23476
FacturaScripts is Vulnerable to Reflected XSS
High
CVE-2026-24788
RaspAP raspap-webgui contains an OS Command Injection vulnerability
Medium
CVE-2026-25129
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
Medium
CVE-2026-24739
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
High
CVE-2026-22243
EGroupware has SQL Injection in Nextmatch Filter Processing
Unrated
CVE-2026-1554
drupal/cas_server - SA-CONTRIB-2026-007
Unrated
CVE-2026-1553
drupal/canvas - SA-CONTRIB-2026-006
High
CVE-2026-24765
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.