High
CVE-2026-21857
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
High
CVE-2025-68455
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2025-68456
Unauthenticated Craft CMS users can trigger a database backup
Medium
CVE-2025-68454
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Medium
CVE-2025-68437
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
Medium
CVE-2025-68436
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
High
CVE-2026-21449
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
High
CVE-2026-21447
Bagisto has IDOR in Customer Order Reorder Functionality
High
CVE-2026-21448
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
High
CVE-2026-21450
Bagisto SSTI vulnerability in type parameter can lead to RCE
Medium
CVE-2026-21451
Bagisto has HTML Filter Bypass that Enables Stored XSS
High
CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
Medium
CVE-2025-69277
libsodium has Incomplete List of Disallowed Inputs
High
CVE-2025-69210
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
High
ghsa-6mp4-q625-mxjp
YOURLS is vulnerable to XSS through JSONP and Callback request parameters
Low
CVE-2025-67746
Composer is vulnerable to ANSI sequence injection
High
CVE-2025-69200
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
Low
ghsa-mgr9-6c2j-jxrq
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Medium
CVE-2025-68951
phpMyFAQ has Stored XSS in user list via admin-managed display_name
High
CVE-2024-42718
Croogo CMS has a path traversal vulnerability
High
CVE-2025-51511
Cadmium CMS has a background arbitrary file upload vulnerability
Medium
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
High
CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
Medium
CVE-2025-14761
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.