Schwachstellen verstehen. Anwendungen schützen.

Niedrig 09.10.2026

CVE-2026-107848

Contao: Cross-Site-Request-Forgery in benutzerdefinierten Backend-Aktionen

Eine Cross-Site-Request-Forgery-Schwachstelle in Contao ermöglicht es Angreifern, zustandsändernde oder destruktive Backend-Aktionen auszuführen, wenn ein angemeldeter Backend-Benutzer eine manipulierte URL aufruft.

Composer

contao/core-bundle

Hoch 24.09.2026

CVE-2026-63498

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Composer

snipe/snipe-it

Mittel 16.09.2026

CVE-2026-61453

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Composer

getgrav/grav

Mittel 31.08.2026

CVE-2026-15305

TYPO3 CMS - Unrestricted File Upload in Form Framework

Composer

typo3/cms-form

Mittel 28.08.2026

CVE-2026-55466

Snipe-IT vulnerable to stored XSS via inline-served attachment

Composer

snipe/snipe-it

Mittel 20.08.2026

CVE-2026-79773

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Composer

winter/wn-system-module

Mittel 20.08.2026

CVE-2026-63179

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Composer

winter/wn-backend-module

Hoch 20.08.2026

CVE-2026-54175

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Composer

backpack/crud

Kritisch 07.08.2026

CVE-2026-72780

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Composer

craftcms/cms

Hoch 06.08.2026

CVE-2026-72786

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Composer

craftcms/cms

Hoch 31.07.2026

CVE-2026-53599

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Composer

redaxo/source

Hoch 24.07.2026

ghsa-rm67-g9ch-vxff

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Composer

poweradmin/poweradmin

Mittel 22.07.2026

CVE-2026-56722

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Composer

dompdf/dompdf

Hoch 15.07.2026

CVE-2026-54491

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Composer

phanan/koel

Hoch 15.07.2026

CVE-2026-54493

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Composer

phanan/koel

Mittel 15.07.2026

CVE-2026-54492

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Composer

phanan/koel

Kritisch 14.07.2026

CVE-2026-45262

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Composer

facturascripts/facturascripts

Mittel 13.07.2026

CVE-2026-52820

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Composer

kimai/kimai

Mittel 09.07.2026

CVE-2026-53638

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Composer

sylius/sylius

Hoch 02.07.2026

CVE-2026-49283

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Composer

simplesamlphp/saml2, simplesamlphp/saml2-legacy

Hoch 26.06.2026

CVE-2026-49260

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Composer

pontedilana/php-weasyprint

Niedrig 19.06.2026

CVE-2026-49209

symfony/ux-live-component: Denial of service via unbounded batch action requests

Composer

symfony/ux-live-component

Mittel 04.06.2026

CVE-2026-48013

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Composer

shopware/core, shopware/platform

Mittel 04.06.2026

CVE-2026-48016

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Composer

shopware/core, shopware/platform