Medium
CVE-2025-22657
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-24944
Subscribe2 <= 10.44 - Missing Authorization
Medium
CVE-2026-24948
Reflector <= 1.2.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-31916
Latest Post Shortcode <= 14.2.1 - Missing Authorization
Medium
CVE-2026-39606
BizReview <= 1.5.14 - Missing Authorization
High
CVE-2026-25157
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand
High
CVE-2026-25253
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
High
CVE-2026-24763
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable
Medium
CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Medium
CVE-2026-25522
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25490
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
Medium
CVE-2026-25489
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
Medium
CVE-2026-25488
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25487
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
Medium
CVE-2026-25486
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
Medium
CVE-2026-25485
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
Medium
CVE-2026-25484
Craft Commerce has Stored XSS in Product Type Name
Medium
CVE-2026-25483
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Medium
CVE-2026-25482
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Medium
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
Low
CVE-2026-25224
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
High
CVE-2026-25223
Fastify's Content-Type header tab character allows body validation bypass
Critical
CVE-2026-25521
locutus is vulnerable to Prototype Pollution
Critical
CVE-2026-25510
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.