High
CVE-2026-33038
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 388
Reset filters
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-32818
Admidio is Missing Authorization on Forum Topic and Post Deletion
Medium
CVE-2026-32757
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Critical
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Medium
CVE-2026-32755
Admidio is Missing CSRF Protection on Role Membership Date Changes
Medium
CVE-2026-32816
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
High
CVE-2026-32263
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Medium
CVE-2026-31825
Sylius has a DQL Injection via API Order Filters
High
CVE-2026-31824
Sylius has a Promotion Usage Limit Bypass via Race Condition
High
CVE-2026-29172
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
High
CVE-2026-29069
Craft CMS has unauthenticated activation email trigger with potential user enumeration
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
High
CVE-2026-27206
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
High
CVE-2026-26990
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
High
CVE-2026-25892
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
High
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Medium
CVE-2026-25492
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
High
CVE-2026-24419
OpenSTAManager has a SQL Injection in the Prima Nota module
High
CVE-2026-24418
OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module
High
CVE-2026-24417
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
High
CVE-2026-24416
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.