High
CVE-2026-54005
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
Medium
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
High
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
High
CVE-2026-55746
Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module
High
CVE-2026-55744
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
High
CVE-2026-11407
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Unrated
CVE-2026-55808
Drupal core - SA-CORE-2026-009
Unrated
CVE-2026-55807
Drupal core - SA-CORE-2026-008
Unrated
CVE-2026-55806
Drupal core - SA-CORE-2026-007
Unrated
CVE-2026-55804
Drupal core - SA-CORE-2026-006
Unrated
CVE-2026-55803
Drupal core - SA-CORE-2026-005
Medium
CVE-2026-55590
CakePHP Authentication: Open redirect weakness via backslash bypass
Medium
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
High
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
Medium
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Medium
CVE-2026-48784
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Medium
CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Medium
CVE-2026-48747
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Medium
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.