High
CVE-2026-71488
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
Medium
CVE-2026-71478
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
Medium
CVE-2026-54717
Silverstripe: XSS in breadcrumbs in page list view
Low
CVE-2026-55825
Contao: Possible path traversal in job download URIs
Low
CVE-2026-55824
Contao crawler leaks auth credentials to external hosts
Medium
CVE-2026-71435
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
Medium
CVE-2026-71434
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
High
CVE-2026-64665
Statamic: Account takeover via OAuth email matching without email-verification check
Medium
CVE-2026-64664
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
Medium
CVE-2026-71293
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
High
CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks
Medium
CVE-2026-69245
Guzzle: Noncanonical cookie domain keeps subdomain scope
Medium
CVE-2026-54768
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
High
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
Medium
CVE-2026-68501
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
High
CVE-2026-68500
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
Unrated
CVE-2026-18260
drupal/disable_login - SA-CONTRIB-2026-110
Low
CVE-2026-52838
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
Low
CVE-2026-52841
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
Medium
CVE-2026-52837
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Low
CVE-2026-52839
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
Low
CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
High
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Critical
CVE-2026-54588
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.