Medium
CVE-2026-32593
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
High
CVE-2026-32258
Winter: Stored XSS through Editor Settings custom styles
High
CVE-2026-32257
Winter: Stored XSS through Brand Settings custom styles
Critical
CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
High
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Critical
CVE-2026-63221
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Medium
CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
Medium
CVE-2026-54164
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
Medium
CVE-2026-62996
Smarty Security stream restriction bypass through stream: resource
Medium
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories
Critical
CVE-2026-72780
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Medium
CVE-2026-72779
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium
CVE-2026-72782
Craft CMS: Authenticated leak of secret environment variables
Medium
CVE-2026-72785
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Medium
CVE-2026-14794
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
Low
CVE-2026-72783
Craft CMS: Incorrect path validation could potentially lead to path traversal
Medium
CVE-2026-72787
Craft CMS: Stored XSS in the control panel via unescaped draft name
High
CVE-2026-67434
PHP_CodeSniffer gitblame report command injection via crafted filename
High
CVE-2026-72786
Craft CMS: Arbitrary user password reset leading to administrator account takeover
High
CVE-2026-72781
Craft CMS: Authenticated RCE through Twig sandbox escape
Medium
CVE-2026-14793
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
High
CVE-2026-72778
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Medium
ghsa-mj63-m3rc-8ppr
league/commonmark: Denial of service via deeply nested XML output
High
CVE-2026-86434
league/commonmark: Denial of service via colliding heading slugs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.