Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filtersdrupal/webform - SA-CONTRIB-2026-168
drupal/webform - SA-CONTRIB-2026-167
drupal/webform - SA-CONTRIB-2026-166
drupal/webform - SA-CONTRIB-2026-165
drupal/webform - SA-CONTRIB-2026-164
drupal/webform - SA-CONTRIB-2026-163
drupal/webform - SA-CONTRIB-2026-162
drupal/webform - SA-CONTRIB-2026-161
drupal/webform - SA-CONTRIB-2026-160
drupal/webform - SA-CONTRIB-2026-159
drupal/webform - SA-CONTRIB-2026-158
drupal/webform - SA-CONTRIB-2026-155
drupal/webform - SA-CONTRIB-2026-154
Solspace Freeform: Limited Twig template injection via submitted field values
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.