Hoch
CVE-2026-41304
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 853
Filter zurücksetzen
Hoch
CVE-2026-41230
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
Hoch
CVE-2026-41231
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
Mittel
CVE-2026-41232
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
Mittel
CVE-2026-41233
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
Mittel
CVE-2026-40486
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
Mittel
CVE-2026-40479
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
Mittel
CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Mittel
CVE-2026-41129
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
Mittel
CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Mittel
CVE-2026-41062
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
Mittel
CVE-2026-41061
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver
Hoch
CVE-2026-41060
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
Mittel
CVE-2026-41058
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
Hoch
CVE-2026-41057
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
Hoch
CVE-2026-41056
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
Mittel
CVE-2026-41055
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
Mittel
CVE-2026-40935
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
Mittel
CVE-2026-40929
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Mittel
CVE-2026-40928
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
Kritisch
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
Hoch
CVE-2026-40909
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
Mittel
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
Mittel
CVE-2026-40907
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.