Medium
CVE-2026-23496
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-23495
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
Medium
CVE-2026-23494
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
High
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
Medium
ghsa-595p-g7xc-c333
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling
High
CVE-2026-23492
Pimcore Has an Incomplete Patch for CVE-2023-30848
Medium
CVE-2025-63644
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
Unrated
CVE-2026-0948
drupal/social_auth_entra_id - SA-CONTRIB-2026-005
Unrated
CVE-2026-0947
drupal/pianoanalytics - SA-CONTRIB-2026-004
Unrated
CVE-2026-0946
drupal/atsmarttag - SA-CONTRIB-2026-003
Unrated
CVE-2026-0945
drupal/role_delegation - SA-CONTRIB-2026-002
Unrated
CVE-2026-0944
drupal/ginvite - SA-CONTRIB-2026-001
High
CVE-2026-23498
Shopware Has Improper Control of Generation of Code in Twig rendered views
Medium
CVE-2022-50807
Concrete5 CMS contains an XPath injection vulnerability
Medium
CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
High
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
Medium
CVE-2025-59021
TYPO3 CMS Allows Broken Access Control in Redirects Module
Medium
CVE-2025-59020
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
CVE-2025-61676
October CMS Vulnerable to Stored XSS via Branding Styles
Medium
CVE-2025-61674
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Medium
CVE-2026-21896
Kirby is missing permission checks in the content changes API
Medium
CVE-2026-22242
CoreShop Vulnerable to SQL Injection via Admin Reports
Medium
CVE-2025-69197
Pterodactyl TOTPs can be reused during validity window
High
CVE-2025-68954
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.