Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,070
Reset filtersSilverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report
ibexa/fieldtype-richtext allows access to external entities in XML
ezsystems/ezplatform-richtext allows access to external entities in XML
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
drupal/panels - SA-CONTRIB-2025-033
drupal/eca - SA-CONTRIB-2025-031
drupal/webt - SA-CONTRIB-2025-030
Shopware default newsletter opt-in settings allow for mass sign-up abuse
wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities
Magento does not properly protect credentials
Magento Improper Access Control leads to Security feature bypass
Magento Improper Access Control leads to Security feature bypass
Magento Improper Authorization vulnerability
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
Joomla Framework Database Package Vulnerable to SQL Injection
Joomla CMS Multi-Factor Authentication Bypass
Shopware Broken ACL on Document retrieval to access other customers documents
Shopware Vulnerable to Blind SQL-injection in DAL aggregations
Pimcore's Admin Classic Bundle allows HTML Injection
Shopware allows Denial Of Service via password length
Shopware 6 allows attackers to check for registered accounts through the store-api
drupal/tacjs - SA-CONTRIB-2025-027
GraphQL grant on a property might be cached with different objects
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.