High
CVE-2026-50635
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Medium
CVE-2026-47742
Shopper: Missing authorization on Product admin Livewire sub-form components
Medium
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Medium
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Medium
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect target
Low
CVE-2026-48011
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
High
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
High
CVE-2026-47696
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
High
CVE-2026-52793
Froxlor's API Authentication bypasses 2FA Authentication
High
CVE-2026-41234
Froxlor: BIND Zone File Injection via TXT Record Content
Medium
CVE-2022-31114
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
Medium
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Medium
CVE-2026-47234
Admidio writes session IDs and auto-login cookie values to application logs
High
CVE-2026-47231
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
Medium
CVE-2026-47230
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
Medium
CVE-2026-47229
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
Medium
CVE-2026-47228
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
Medium
CVE-2026-47227
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
Medium
CVE-2026-47226
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
High
CVE-2026-47260
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
High
CVE-2026-41236
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
High
CVE-2026-41235
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.