High
CVE-2026-25458
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-25454
The League <= 4.4.1 - Missing Authorization
Medium
CVE-2026-25306
XStore Core <= 5.6.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-25461
Listeo-Core - Directory Plugin by Purethemes <= 2.0.21 - Reflected Cross-Site Scripting
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-32818
Admidio is Missing Authorization on Forum Topic and Post Deletion
Medium
CVE-2026-32757
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Critical
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Medium
CVE-2026-32812
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
Medium
CVE-2026-32755
Admidio is Missing CSRF Protection on Role Membership Date Changes
Medium
CVE-2026-32816
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
High
CVE-2026-32756
File Upload(RCE) Vulnerability in admidio
Medium
CVE-2026-33572
OpenClaw session transcript files were created without forced user-only permissions
High
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
High
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
High
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Medium
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
High
CVE-2026-32728
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
High
CVE-2026-32268
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
High
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Low
CVE-2026-32266
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
Medium
CVE-2026-32265
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.