High
CVE-2026-64850
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
High
CVE-2026-81892
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Medium
CVE-2026-81887
Livewire DOM-based cross-site scripting during client-side state handling
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-19418
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Medium
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Low
CVE-2026-84307
Filament: Password validity disclosure for accounts denied panel access on login page
High
CVE-2026-77567
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
High
CVE-2026-86428
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
High
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
High
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
High
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Medium
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Medium
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
High
CVE-2026-71415
Kirby: File upload permissions are not checked during processing of chunk data
High
CVE-2026-75594
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
High
CVE-2026-81889
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
Medium
CVE-2026-15305
TYPO3 CMS - Unrestricted File Upload in Form Framework
High
CVE-2026-55843
Snipe-IT has an Improper Privilege Management issue
Medium
CVE-2026-55779
silverstripe/versioned has XSS in archive admin restore
Low
CVE-2026-55891
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Medium
CVE-2026-55696
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.