Medium
CVE-2026-23495
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
Medium
CVE-2026-23494
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
High
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
Medium
ghsa-595p-g7xc-c333
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling
High
CVE-2026-23492
Pimcore Has an Incomplete Patch for CVE-2023-30848
Unrated
CVE-2026-0948
drupal/social_auth_entra_id - SA-CONTRIB-2026-005
Unrated
CVE-2026-0945
drupal/role_delegation - SA-CONTRIB-2026-002
Unrated
CVE-2026-0944
drupal/ginvite - SA-CONTRIB-2026-001
High
CVE-2026-23498
Shopware Has Improper Control of Generation of Code in Twig rendered views
Medium
CVE-2022-50807
Concrete5 CMS contains an XPath injection vulnerability
Medium
CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
High
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
Medium
CVE-2026-21896
Kirby is missing permission checks in the content changes API
Medium
CVE-2026-22242
CoreShop Vulnerable to SQL Injection via Admin Reports
High
CVE-2025-68954
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
High
CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
High
CVE-2025-68455
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2025-68456
Unauthenticated Craft CMS users can trigger a database backup
Medium
CVE-2025-68454
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Medium
CVE-2025-68437
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
High
CVE-2026-21449
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
High
CVE-2026-21447
Bagisto has IDOR in Customer Order Reorder Functionality
High
CVE-2026-21448
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
High
CVE-2026-21450
Bagisto SSTI vulnerability in type parameter can lead to RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.