Medium
CVE-2026-48014
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 67
Reset filters
Medium
CVE-2026-48010
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Medium
CVE-2026-48008
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
High
CVE-2026-41237
Froxlor has an incomplete fix for CVE-2026-30932
Medium
CVE-2026-8327
Concrete CMS has a session-hardening bypass and allows password change without reauthorization
Medium
CVE-2026-47741
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
High
CVE-2026-107376
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
High
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
High
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
High
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
High
CVE-2026-33687
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
Medium
CVE-2026-32812
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
High
CVE-2024-52293
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
Low
CVE-2024-50345
Symfony vulnerable to open redirect via browser-sanitized URLs
Low
CVE-2024-50343
Symfony has an incorrect response from Validator when input ends with `\n`
High
CVE-2024-43372
Persistent Cross-site Scripting in eZ Platform Rich Text Field Type
High
CVE-2024-43369
Persistent Cross-site Scripting in Ibexa RichText Field Type
Medium
CVE-2024-47069
Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar
Medium
ghsa-96c6-m98x-hxjx
Zend-Session session validation vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.