Medium
CVE-2026-55593
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
Medium
CVE-2026-54543
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
High
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
High
CVE-2026-55224
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Critical
CVE-2026-54133
jmespath.php has CompilerRuntime code injection via unescaped function names
High
CVE-2026-55182
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
High
CVE-2026-53653
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
High
CVE-2026-55072
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
Unrated
CVE-2026-73476
drupal/externalauth - SA-CONTRIB-2026-098
Unrated
CVE-2026-73474
drupal/entity_share_websub - SA-CONTRIB-2026-097
Unrated
CVE-2026-73475
drupal/commerce_paypal - SA-CONTRIB-2026-095
Medium
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Medium
CVE-2026-45694
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
High
CVE-2026-35445
Winter: Authenticated backend users can bypass Users controller permission checks
Medium
CVE-2026-32639
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Medium
CVE-2026-32593
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
High
CVE-2026-32258
Winter: Stored XSS through Editor Settings custom styles
High
CVE-2026-32257
Winter: Stored XSS through Brand Settings custom styles
High
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Critical
CVE-2026-63221
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Medium
CVE-2026-62996
Smarty Security stream restriction bypass through stream: resource
Medium
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories
Critical
CVE-2026-72780
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.