Browse CVEs by Ecosystem and Severity

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Kirby: Access to image files outside of the site root via path traversal in the media handling

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Snipe-IT has CSS Injection via `header_color` Setting

Snipe-IT vulnerable to stored XSS via inline-served attachment

Snipe-IT: Stored DOM XSS via table selected-count IDs

LibreNMS Vulnerable to Remote Code Execution via AboutController

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

TYPO3 CMS has Insecure Deserialization via Core API

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Kirby has XML injection in its XML creator toolkit

phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Sylius has an Open Redirect via Referer Header

Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

Concrete5 CMS contains an XPath injection vulnerability

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Bagisto has HTML Filter Bypass that Enables Stored XSS

phpMyFAQ contains a CSV injection vulnerability

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability

Drupal Open Social Missing Authorization vulnerability

Drupal AI Cross-Site Request Forgery (CSRF) vulnerability

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Magento Open Source Improper Input Validation vulnerability

Magento Open Source Cross-Site Scripting (XSS) vulnerability

Twig has a possible sandbox bypass

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Magento Open Source allows Cross-Site Scripting (XSS)

pubnub Insufficient Entropy vulnerability

TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes

TinyMCE XSS vulnerability in notificationManager.open API

TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin

Magento Open Source allows SQL Injection

Magento Open Source allows SQL Injection

Magento Open Source allows SQL Injection

Magento Open Source allows Incorrect Authorization

Cross-site scripting vulnerability in TinyMCE alerts

Bootstrap vulnerable to Cross-Site Scripting (XSS)

Cross-site scripting vulnerability in TinyMCE plugins