Skip to content
OpenAdvisories

Category

Web / CMS

26,697 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-119977 Exploited Public exploit

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…

    WordPress Foundation WordPress wordpress Web / CMS Debian
    KEV Nov 3, 2026
  • High 8.1
    CVE-2026-87902 Exploited Public exploit EPSS 96%

    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.p…

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
    KEV Sep 25, 2026
  • High 7.5
    CVE-2026-49049 Exploited Public exploit

    Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

    The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

    joomshaper.com Helix3 extension for Joomla Web / CMS
  • High 7.5
    CVE-2021-43798 Exploited Public exploit EPSS 89%

    Grafana path traversal

    Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

    Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go
    KEV Oct 9, 2025
  • High 8.8
    CVE-2020-13671 Exploited Public exploit EPSS 36%

    Drupal core Unrestricted Upload of File with Dangerous Type

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
    KEV Jan 18, 2022
  • High 8.8
    CVE-2019-3398 Exploited Public exploit EPSS 97%

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote a…

    Atlassian Confluence Web / CMS
    KEV Nov 3, 2021
  • High 8.1
    CVE-2019-6340 Exploited Public exploit EPSS 92%

    Drupal core - Highly critical - Remote Code Execution

    Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
    KEV Mar 25, 2022