Medium
CVE-2026-47348
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Low
CVE-2026-47344
TYPO3 HTML Sanitizer allows Cross-site Scripting
Medium
ghsa-6jq6-x4cx-qvcm
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
Medium
CVE-2026-48067
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Critical
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
Medium
CVE-2026-53723
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
Medium
CVE-2026-48998
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Medium
CVE-2026-49214
guzzlehttp/psr7 has CRLF Injection via URI Host Component
Unrated
CVE-2026-11915
drupal/bfap_sb - SA-CONTRIB-2026-047
Unrated
CVE-2026-11914
drupal/composer - SA-CONTRIB-2026-046
Unrated
CVE-2026-11913
drupal/mothermayi - SA-CONTRIB-2026-045
Unrated
CVE-2026-11909
drupal/examples - SA-CONTRIB-2026-044
Unrated
CVE-2026-11908
drupal/tagify - SA-CONTRIB-2026-043
High
CVE-2026-10721
Concrete CMS: PHP Object Injection via unserialize() calls
Medium
CVE-2026-53675
BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR
High
CVE-2026-53673
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Critical
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Medium
CVE-2026-47767
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
High
CVE-2026-50636
LimeSurvey has a SQL Injection issue
High
CVE-2026-50635
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
Medium
CVE-2026-47693
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
Critical
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
High
CVE-2026-47732
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
Low
CVE-2026-47730
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.