High
CVE-2026-9809
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
High
CVE-2026-9808
Mautic has an Authorization Bypass in API v2 Endpoints
Critical
CVE-2026-9559
Mautic vulnerable to Path Traversal via Campaign Import
Critical
CVE-2026-9558
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Medium
CVE-2026-9557
Mautic Focus component Vulnerable to SSRF
High
CVE-2026-4776
Mautic has SQL Injection in API Contact Filtering
Medium
CVE-2026-90935
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
Medium
CVE-2026-90936
Froxlor: Authenticated customers can read other customers' allowed sender aliases
High
CVE-2026-50284
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Medium
CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Medium
CVE-2026-50280
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
High
CVE-2026-50279
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
High
CVE-2026-52854
mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function
Low
CVE-2026-80196
Kimai Password Reset Link Remains Valid After Password Change
High
CVE-2026-49981
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
Low
ghsa-hwmc-r6mf-jh83
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
Medium
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Unrated
CVE-2026-58591
drupal/colorbox - SA-CONTRIB-2026-069
Unrated
CVE-2026-58590
drupal/flowdrop - SA-CONTRIB-2026-068
Unrated
CVE-2026-58589
drupal/flowdrop - SA-CONTRIB-2026-067
Unrated
CVE-2026-58588
drupal/canvas - SA-CONTRIB-2026-066
Unrated
CVE-2026-58587
drupal/canvas - SA-CONTRIB-2026-065
Medium
CVE-2026-55219
Paymenter has race condition in payWithCredit() that enables credit double-spend
Medium
CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.