Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 67

Reset filters

Low 09.10.2026

CVE-2026-107848

Contao: Cross-site request forgery in custom backend actions

A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.

High 24.09.2026

CVE-2026-63498

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Medium 16.09.2026

CVE-2026-61453

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Medium 31.08.2026

CVE-2026-15305

TYPO3 CMS - Unrestricted File Upload in Form Framework

Medium 28.08.2026

CVE-2026-55466

Snipe-IT vulnerable to stored XSS via inline-served attachment

Medium 20.08.2026

CVE-2026-79773

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Medium 20.08.2026

CVE-2026-63179

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

High 20.08.2026

CVE-2026-54175

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Critical 07.08.2026

CVE-2026-72780

Craft CMS: Passkey login accepts replayed WebAuthn assertions

High 06.08.2026

CVE-2026-72786

Craft CMS: Arbitrary user password reset leading to administrator account takeover

High 31.07.2026

CVE-2026-53599

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

High 24.07.2026

ghsa-rm67-g9ch-vxff

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Medium 22.07.2026

CVE-2026-56722

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

High 15.07.2026

CVE-2026-54491

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

High 15.07.2026

CVE-2026-54493

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Medium 15.07.2026

CVE-2026-54492

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Critical 14.07.2026

CVE-2026-45262

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Medium 13.07.2026

CVE-2026-52820

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Medium 09.07.2026

CVE-2026-53638

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

High 02.07.2026

CVE-2026-49283

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

High 26.06.2026

CVE-2026-49260

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Low 19.06.2026

CVE-2026-49209

symfony/ux-live-component: Denial of service via unbounded batch action requests

Medium 04.06.2026

CVE-2026-48013

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Medium 04.06.2026

CVE-2026-48016

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Showing 1 to 24 of 67 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 67

Know which vulnerabilities affect your application

Application security in your inbox