Kritisch
CVE-2026-42607
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 853
Filter zurücksetzen
Hoch
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
Mittel
CVE-2026-42207
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
Kritisch
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Mittel
CVE-2026-43878
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
Mittel
CVE-2026-43876
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
Mittel
CVE-2026-43875
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
Hoch
CVE-2026-43874
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
Hoch
CVE-2026-43873
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
Hoch
CVE-2026-107376
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
Hoch
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
Hoch
CVE-2026-100856
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Mittel
CVE-2026-100855
AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration
Mittel
CVE-2026-100854
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
Hoch
CVE-2026-42606
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Mittel
CVE-2026-41890
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Mittel
CVE-2026-42174
Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
Hoch
CVE-2026-42069
Kirby CMS's read access to site, user and role information is not gated by permissions
Hoch
CVE-2026-42137
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
Mittel
CVE-2026-41671
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
Hoch
CVE-2026-41670
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
Hoch
CVE-2026-41669
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
Niedrig
CVE-2026-41663
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
Mittel
CVE-2026-41661
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.