Website and server vulnerability directory
Understand selected CVEs, affected software and available fixes — with links to official records and vendor advisories.
Selected records associated with our July–October 2026 platform advisories. This is a dated snapshot, not a complete CVE feed or a live scan. Only published records retrieved from the official CVE List are included.
What should you fix first?
Start with confirmed exploitation affecting software you actually run, then externally reachable issues with severe impact. Check authentication requirements, configuration and available patches. “Critical” severity does not automatically mean every installation is vulnerable.
- CVE-2026-103849Magento — Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- CVE-2026-105642Ghost — Ghost: Remote Code Execution via Bookmark Card Images
- CVE-2026-105643Ghost — Ghost: Stored XSS via Embed Card Previews
- CVE-2026-105647Ghost — Ghost: Server-Side Request Forgery in Bookmark Fetching
- CVE-2026-105679Ghost — Ghost: Stored XSS via File Uploads on Local Storage
- CVE-2026-109618PHP — RCE via OOM corruption
- CVE-2026-109619PHP — RCE via stale global state
- CVE-2026-15370Linux servers — Libssh: libssh: stack buffer overflow in sftp server longname construction
- CVE-2026-17543PHP — SQL injection in ext-pgsql via E'...' backslash breakout
- CVE-2026-17544PHP — Out-of-bounds write in bccomp() via crafted operand and scale
- CVE-2026-35189Linux servers — Excessive Memory Allocation in Relative CRLDP Processing
- CVE-2026-59847Linux servers — Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
- CVE-2026-64638WordPress — Login-screen reflected scripting
- CVE-2026-65640WordPress — Uploaded files can trigger code execution
- CVE-2026-71362Magento — Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-73337Joomla — Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2
- CVE-2026-75650Magento — Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- CVE-2026-76200Magento — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-76201Magento — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-77696Linux servers — Timing Side-Channel in SM2 Signature Generation
- CVE-2026-84383Ghost — libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
- CVE-2026-90907Joomla — Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-90915Joomla — Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-91767PHP — Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
- CVE-2026-91768PHP — IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
- CVE-2026-91769PHP — TLS Hostname Verification Falls Back to CN After SAN Mismatch
- CVE-2026-92227Joomla — Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- CVE-2026-92909Magento — Adobe Commerce | Incorrect Authorization (CWE-863)