High
CVE-2026-55416
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 138
Reset filters
Critical
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Critical
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
High
CVE-2026-55212
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
High
CVE-2026-55072
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
High
CVE-2026-11407
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
High
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
High
CVE-2026-45704
Pimcore has a CustomReports Share Bypass
Medium
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
High
CVE-2026-45260
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
High
CVE-2026-45162
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
High
CVE-2026-44739
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
Medium
CVE-2026-5362
Pimcore has an authenticated Cross-site Scripting issue
Medium
CVE-2026-27461
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
Medium
CVE-2026-23494
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
High
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
High
CVE-2026-23492
Pimcore Has an Incomplete Patch for CVE-2023-30848
Medium
CVE-2025-27617
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
High
CVE-2024-11954
Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document
High
ghsa-hq76-662x-7mw4
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
Medium
CVE-2024-41109
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
High
CVE-2024-32871
Flooding Server with Thumbnail files
Medium
ghsa-vjwg-28gv-pm8h
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
High
CVE-2023-47637
Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.